0d60bc587b5e80c03345dff692b6de492dee7bd946f2522086a00992e9561757

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/am.pak
Size

307KB
MD5

3e292ba6a915ec8b8f2408e71c03425f
SHA1

c8f4ae13011061239fbcb837d2e2f84a9e876e3e
SHA256

ff9412b525b65672142841dbef0f334279b5302cd9712710bdc7143584f8b502
SHA512

8a5f4531fe7aed67cd146fb53772fd5a3fae9aa24eb4f58ddcda5ac56fc6fa22fa8fbb824faf8abac992c5c0d24446593dd05ffe106d2c29fbba0fb5a095c5ed
SSDEEP

3072:U7Mm7p47Qa9PTdOWZpHuUGHwAIeFfHe/RmowkBEDCSQn6OFD2VxPo9oVA/m4/WPO:U7MPvT5+wezYgxP1jW5yGQauQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1956	1700	cmd.exe	32
PID 1700 wrote to memory of 1956	1700	cmd.exe	32
PID 1700 wrote to memory of 1956	1700	cmd.exe	32
PID 1956 wrote to memory of 2720	1956	rundll32.exe	33
PID 1956 wrote to memory of 2720	1956	rundll32.exe	33
PID 1956 wrote to memory of 2720	1956	rundll32.exe	33
PID 1956 wrote to memory of 2720	1956	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\am.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\am.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\am.pak"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
42b6c6a0dd7ea545116f5fddb63365d9

SHA1
9a5bde988eeb030fa99004f7d20c20ff145c7f63

SHA256
3dc1d49300381ed6b5a607b4af9ee5a496434a27ef0c50348e30ef9df3ff95cf

SHA512
3966d66125f031a298c6fd2172d897b194fe14b91759dc1e49157b70c792b53488b426aaa5ea717ed505de36b378ab63c972dbe0afcb4b51c78e6c9ce3703ce1

Download Submit