4d8daf45a5fcf7480739974e1d9ecac7370462f66196dd14b9a38020120dc202

Resubmissions

02/06/2024, 23:20

240602-3bvxlaag6v 7

02/06/2024, 23:16

240602-29dwasbg87 4

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ar.pak
Size

680KB
MD5

5cb81a90a403e951c8d8e6c797dfcdc9
SHA1

b38be201bf70c9be103c0a4adfadd1b5c60901e0
SHA256

a17cb6b8c7331b9653981cafbea39a4fbfb3962f6b81367c3704e1682940fdfc
SHA512

0907d7a7594cd7bfdd17a652f801bf7198f8e2674241935a0215dd729d7b42a3464a8ec30bf8eecaf988188e9fe5fde8d11da1cfcebf0ba1c1a0233efb09d581
SSDEEP

12288:Db7IhLZtD9J7O08vYU3X1Y9kbMf5MNi/+det13zMgSENR5:nmJta45F+K

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2672	2144	cmd.exe	29
PID 2144 wrote to memory of 2672	2144	cmd.exe	29
PID 2144 wrote to memory of 2672	2144	cmd.exe	29
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ar.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
768da8716dfd571f4382321276451cd9

SHA1
4106d9d8bdd324c3d0e96302c80ba163c63eab67

SHA256
3130cad59f1c2871f396484f86570d1c55bfd4e8277997b0af3f58e946328ab8

SHA512
b566e7e45fe6c53a75b29ae6be7fbf496a37be2cdcbf697ee674177da096ba013cd6636ccc8aa42df4524878a49c67558968e588ab74cd8a2a30e3107a7fa9d3

Download Submit