564474f891b8da92851e93c2dfaeb67274abd69b6498ada12665a72fe00e69de

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/cs.pak
Size

409KB
MD5

eeee212072ea6589660c9eb216855318
SHA1

d50f9e6ca528725ced8ac186072174b99b48ea05
SHA256

de92f14480770401e39e22dcf3dd36de5ad3ed22e44584c31c37cd99e71c4a43
SHA512

ea068186a2e611fb98b9580f2c5ba6fd1f31b532e021ef9669e068150c27deee3d60fd9ff7567b9eb5d0f98926b24defabc9b64675b49e02a6f10e71bb714ac8
SSDEEP

6144:RquUIAMYOnQYeAIV4g558YwGKNDsku8Qy:Rq/IA5On504g558YwbNDsC

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2240	2612	cmd.exe	32
PID 2612 wrote to memory of 2240	2612	cmd.exe	32
PID 2612 wrote to memory of 2240	2612	cmd.exe	32
PID 2240 wrote to memory of 2684	2240	rundll32.exe	33
PID 2240 wrote to memory of 2684	2240	rundll32.exe	33
PID 2240 wrote to memory of 2684	2240	rundll32.exe	33
PID 2240 wrote to memory of 2684	2240	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\cs.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30479c3eb37948032cde2f9aa42e66d0

SHA1
f10ac5f5885b5f5767acfa06afef88039373eaf0

SHA256
4f22a6f2ebf833a17256b39a532e5b6b8dbdfa30b62d0e47b94536631ebec9fc

SHA512
114b0cd2700cdfafcd29f6fa25142066530c81da5e9337f7c74905e080954601801523df2edc67525f7926ad873f519ff481d86af3378e0775afae10538ef72c

Download Submit