249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/am.pak
Size

150KB
MD5

5c617f3833923fca5717a549fa57adca
SHA1

0102ac3c8041fab6a1a65a3bcaf7e79c0b7fd719
SHA256

5f323c0bd185d5bd5f7ea737018f14fd6ea500ba5440bc74f5c09b635518eadc
SHA512

87034e798355875f3459567ed1f11e5455fc5adc9634eec33e9db2446451febf7f35f617709a9b09bf3bc52f195edea0cb47d474d2c11ca93a8b5383142d45e9
SSDEEP

3072:nJ1NSM/92t7Rh4rgEkDvuHq/VoZLokijEG/yZJjh6oVjUWRSuo90kef97ZVt1nnu:nzym+u9QfCx30jH8+x

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2644 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2644 AcroRd32.exe
2644 AcroRd32.exe

pid	process
2644	AcroRd32.exe

pid	process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 2280	2076	cmd.exe	rundll32.exe
PID 2076 wrote to memory of 2280	2076	cmd.exe	rundll32.exe
PID 2076 wrote to memory of 2280	2076	cmd.exe	rundll32.exe
PID 2280 wrote to memory of 2644	2280	rundll32.exe	AcroRd32.exe
PID 2280 wrote to memory of 2644	2280	rundll32.exe	AcroRd32.exe
PID 2280 wrote to memory of 2644	2280	rundll32.exe	AcroRd32.exe
PID 2280 wrote to memory of 2644	2280	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\am.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\am.pak
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\am.pak"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a52f57475cc4d512cd30f819659200f6

SHA1
d467144c10cccb3da532216fa21ed2e78f2dcae8

SHA256
7d8bfe078f7a3b95e1acf489caa2ff883be14e0c6c85f9e22a847addde0ac4e9

SHA512
31de862af2f087697352db590f9646bb1802bda6e82e776dcc0af85d4d89391fad159546312ca00ecff809a2a5c4e8834690fdb17c5d2faeb5b68dad29dbb3f5

Download Submit