45fba5ff230560743a08cb0e423cbaa25b5c191593a084b536d1baf7702d59ce

Analysis

max time kernel
104s
max time network
28s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ledger_Live/Ledger/locales/de.pak
Size

427KB
MD5

169d036fc78554a8011c72644d7c8129
SHA1

5bf6df20d0f4383c1162e787d019e822cea6a87e
SHA256

5883c8b60f43c5e12437eefa5d74dacf9c16e6187526df74a53f2eca9e6f3d62
SHA512

e9bb8eafc47986063892070ae57d6da5a996d68b2c2460f1672abe4e047628b50410cdf72d627d38e15abea7647c686bd30bd7f80648f1058f9a9f3b7a10309c
SSDEEP

6144:uHtYAzLSELPighAa598U/xCP3T7X2mAyRc5rRRN1OI8CLM:uNeELaguaQn7X295T98CLM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pak_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2728	2380	cmd.exe	30
PID 2380 wrote to memory of 2728	2380	cmd.exe	30
PID 2380 wrote to memory of 2728	2380	cmd.exe	30
PID 2728 wrote to memory of 2664	2728	rundll32.exe	31
PID 2728 wrote to memory of 2664	2728	rundll32.exe	31
PID 2728 wrote to memory of 2664	2728	rundll32.exe	31
PID 2728 wrote to memory of 2664	2728	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ledger_Live\Ledger\locales\de.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ledger_Live\Ledger\locales\de.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ledger_Live\Ledger\locales\de.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
65e975cdf0e8dfa2dbe58b3f1fbdc149

SHA1
0944d6c241472ccb24d7a7ae855751555bd8154d

SHA256
7f79e6bdf981f1b0b2fb0aacf80aa0f77cbfbe4b5b9750d878f997ed7a7b59e0

SHA512
b3cab22fe4ad1ef52e4a8cff63e262c46b38926cf0f8e9c1ead5aa04c638bf8e1aac5614d313d38331c486c2eeab8153c488e935af39fd51b364cf93fc08a996

Download Submit