249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome_100_percent.pak
Size

138KB
MD5

03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1

dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256

c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512

c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
SSDEEP

3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2512 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2512 AcroRd32.exe
2512 AcroRd32.exe

pid	process
2512	AcroRd32.exe

pid	process
2512	AcroRd32.exe
2512	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3032 wrote to memory of 2716	3032	cmd.exe	rundll32.exe
PID 3032 wrote to memory of 2716	3032	cmd.exe	rundll32.exe
PID 3032 wrote to memory of 2716	3032	cmd.exe	rundll32.exe
PID 2716 wrote to memory of 2512	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2512	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2512	2716	rundll32.exe	AcroRd32.exe
PID 2716 wrote to memory of 2512	2716	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7f807bdbd3b99738b01b013092587ca0

SHA1
2dd2807923fb628f6d0086b9877afe4c134036e4

SHA256
6a933eb52ec50c6b5910b61d532e5951795db55901b02288934d1b207b92d864

SHA512
b0e6ea5f78962c61f725367c08cf316aee656988fc9d2a3aa4cf469f05a22996bdcb86712a95b41daa0804f2bb59d4035ee862d9ee6c60bca7a15503e30cd931

Download Submit