249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ar.pak
Size

153KB
MD5

8f9c8dd93b03202220b5e226c6956025
SHA1

8290dba9b8dcc89928821ead04f7cf599c0ba557
SHA256

e7f9a474399c0ca0daf28c6153f6ec7ae87423e66c8ffe0849407471d20b6237
SHA512

3eb0b80cc7243ed646cfc7be31eb27f0aa15f2aa8a5d2c50c3e5efd8a81759637e3f986c5c294262ff3bc94a939bb3803268b4eda46b3cfe224f596bfb4ed00a
SSDEEP

3072:91mmOGHNSNRZaJTGxRh+7iMuxHSM2uZtE9yKBZ1F/R2bKSI1+/BI1Iir2L2p:zjOlNRQs+7i0g/BI1Zp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2088 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2088 AcroRd32.exe
2088 AcroRd32.exe

pid	process
2088	AcroRd32.exe

pid	process
2088	AcroRd32.exe
2088	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2632 wrote to memory of 2704	2632	cmd.exe	rundll32.exe
PID 2632 wrote to memory of 2704	2632	cmd.exe	rundll32.exe
PID 2632 wrote to memory of 2704	2632	cmd.exe	rundll32.exe
PID 2704 wrote to memory of 2088	2704	rundll32.exe	AcroRd32.exe
PID 2704 wrote to memory of 2088	2704	rundll32.exe	AcroRd32.exe
PID 2704 wrote to memory of 2088	2704	rundll32.exe	AcroRd32.exe
PID 2704 wrote to memory of 2088	2704	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ar.pak"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15be8c938ed6525e6c22ec9a783cf3a1

SHA1
cb26ee2862f86ddcf635b1d713033be2a74bf535

SHA256
3288aff24bd8519aa4b86f2a33d5265ba4df64a02129a0b68c90043890583d0d

SHA512
4b5887cb3972ef288954f22ccf8ec21f25b93e99e9a1c40ba2391da77a02d5215c4b4dd60c55b023b563b56a4aceb6e1731facb814de40aef2c9388acf7723e1

Download Submit