eb8afbda006962da47bf99f5ecc2d73ae2d51f293965ae4ad637acbf55108645

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240611-de
resource tags

arch:x64arch:x86image:win7-20240611-delocale:de-deos:windows7-x64systemwindows
submitted
13-06-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ur.pak
Size

552KB
MD5

ba86f1f13fdc37a2c48c1da34c84f4c4
SHA1

2f1578d0eee76e60effb63967712b15c0d56829e
SHA256

4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
SHA512

fb2fe1548574da860bf27408a4f29d781fcefc300f744f4214843f343e343ad8bae29cb7047f87f5c3277641f561c6a30e5bc9d6490afbefc7af36974305a688
SSDEEP

12288:+ebg/8PzMVEOyMKdAMBa5UUEA2Wb9YQYrtu+co/9NjjFpvJ1:+XHD5gWQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2232	2212	cmd.exe	28
PID 2212 wrote to memory of 2232	2212	cmd.exe	28
PID 2212 wrote to memory of 2232	2212	cmd.exe	28
PID 2232 wrote to memory of 2480	2232	rundll32.exe	29
PID 2232 wrote to memory of 2480	2232	rundll32.exe	29
PID 2232 wrote to memory of 2480	2232	rundll32.exe	29
PID 2232 wrote to memory of 2480	2232	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ur.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ur.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ur.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b4c196b2732a9e173c00a4ec32d19a34

SHA1
56635175d62b3582525fa64405f512259be9a2e5

SHA256
7ebfbe17d7fa50781d6dcf0ac206d0333989fc9ccf08c90e577f31e3f2856fb3

SHA512
06831a5dd8b1acb56eb69c80f2f46767e94aa9c0edbe0b0156ebd14b16af7cb93872230d5eaddb6c2e7646f4ce1ffa2d7437f47a06970ce7a820c2c61a30a676

Download Submit