56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome_100_percent.pak
Size

126KB
MD5

a3d4515d3a33a407d313a62818e82a5d
SHA1

967ff9a6774a66f7b3299af4fd5d70961ed54d79
SHA256

662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0
SHA512

0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801
SSDEEP

3072:KKzwqCT4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39Vm2I:KKzwt49NPyCtoK18Gb0OV8ld0GecQ3f2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2640	3036	cmd.exe	29
PID 3036 wrote to memory of 2640	3036	cmd.exe	29
PID 3036 wrote to memory of 2640	3036	cmd.exe	29
PID 2640 wrote to memory of 2544	2640	rundll32.exe	30
PID 2640 wrote to memory of 2544	2640	rundll32.exe	30
PID 2640 wrote to memory of 2544	2640	rundll32.exe	30
PID 2640 wrote to memory of 2544	2640	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\chrome_100_percent.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c153141d5b8729d5a6a20915d0e9dcf7

SHA1
627c1a89d4f2153936b8c0fb3a072c5207fa33a7

SHA256
6cdb3684b2fa61b24c90178ecc46c833ef1061df78521aec3f8971cf2adcd112

SHA512
51576696f3361a22659e39fdb3e59bf6e25e80eb227dc36c716114f596af64c5f7789b5ff3fddc4e508437054c49b694f368c2ec93ea84f936a85fbf1c7d256f

Download Submit