b793adade7cd9f14d1e6a9b066257092f45b77e9bfe4ca5d481dbce2638a7dbe

Analysis

max time kernel
1563s
max time network
1566s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Bin/translations/qt_ca.qm
Size

205KB
MD5

1d351670ea821db3bbb5aee0ad186f10
SHA1

ac0548eb87e7e4a12a604523713e5b08df88fb50
SHA256

235f502810d5750a47421d3e57620dcae5cfcfd83bc97766ad8b99b75238a544
SHA512

7a769f0c0858c25ebbbdd25c7308523ed298e35e2b5533981967773cf7d08899d81d05d34d67567bb48fb0de21b3ce9c9d83866ec701dc841f8b430eadb43e29
SSDEEP

3072:GQKRldlzfzvZfeW+6kXEVjSVPzC3ceKdP2:aff7UW+WjwP2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.qm	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.qm\ = "qm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\qm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2264	1316	cmd.exe	31
PID 1316 wrote to memory of 2264	1316	cmd.exe	31
PID 1316 wrote to memory of 2264	1316	cmd.exe	31
PID 2264 wrote to memory of 2808	2264	rundll32.exe	32
PID 2264 wrote to memory of 2808	2264	rundll32.exe	32
PID 2264 wrote to memory of 2808	2264	rundll32.exe	32
PID 2264 wrote to memory of 2808	2264	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bin\translations\qt_ca.qm
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bin\translations\qt_ca.qm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bin\translations\qt_ca.qm"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d78baeedad388fd86935f6188903047

SHA1
c7f3cf78486d557ab735bc0b24f55a4711e09a64

SHA256
1c7924218866d0116bb4835368e88bb4ac07d3c2aaea36ddc9df12441f420387

SHA512
642947a93d9e034aebab0cf0716ac6568fa4b8456c7b1a6a6f49078f110af9cf80278411ea62df0b9035526d87139f9ef274951d2cac06f12cb0d2e41af43d4e

Download Submit