88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b

Resubmissions

29/06/2024, 22:21

240629-19544s1epm 7

29/06/2024, 22:13

240629-145amaxfjc 7

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources.pak
Size

5.2MB
MD5

ecf9792c09b7084c8151c15307b48cc4
SHA1

88fdd2b60cdf571a52a03abd794114bff720520c
SHA256

947fb87beb5edfe3b33899e6df6961ddd1cba0734f8a1192eed4ca41276e9be8
SHA512

716e378842888f6aef1122374324d03a00661238568f86db5af796c8ef4eb48005001df2cc4134f9d3e6e59f133b006e3f11d1fa619118e6f2925058d8449d8c
SSDEEP

98304:5EPFNXMmWPVctFCZnSEVHYxh1Z/p6uNXrwrXRVunEVvXjNSfz3hIkrT7s:5EPFNXMddCMrIhz/xpkrX2nEVvXJAqkQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2608	1292	cmd.exe	29
PID 1292 wrote to memory of 2608	1292	cmd.exe	29
PID 1292 wrote to memory of 2608	1292	cmd.exe	29
PID 2608 wrote to memory of 2508	2608	rundll32.exe	30
PID 2608 wrote to memory of 2508	2608	rundll32.exe	30
PID 2608 wrote to memory of 2508	2608	rundll32.exe	30
PID 2608 wrote to memory of 2508	2608	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e679ab934015486597b9719d3adbc0e3

SHA1
d956a998e0ae01fe6f9addfbdc1b22f4c09ee38b

SHA256
9b2ba77e26a6b04ee31a53abecc7beab303df236dc57d30dfc46ab11b608fe5e

SHA512
84095fb9c11bfda02f613fb0250c34e79711e1f36bacb38bc6be619b7acfc226411bb64a226cd4d473375c42e9b94d2628bf74d2d597a347023810a27560d271

Download Submit