c5fd5691f4eec136f0bdbfbc3f84c0f70cb0b39d03ea4402eace25b90a699c82

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/cs.pak
Size

103KB
MD5

6817671b166242686c18b0d17dc15a80
SHA1

cb2b238fa29cc6d8e6abe5f036d0d00b8009b571
SHA256

0c554977f587f1910ab077d99b97f5011f5c466f0b6d86df08f9a4c7c940d99f
SHA512

508c1207fdbd5752ab95041900c4b453dadeaa58e17feb5c86e911c75b4703050db8fb801aba3aca74f4daca52d94240e5e5c99b1f267e2dcaf521f8be19cc24
SSDEEP

1536:ajgv5LSPwmjLVAM1g33zxjGlXq/dheR1PC8QUQdbiE:ajnIQ0Gl6/PeC8QUQdbd

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.pak	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2364	808	cmd.exe	31
PID 808 wrote to memory of 2364	808	cmd.exe	31
PID 808 wrote to memory of 2364	808	cmd.exe	31
PID 2364 wrote to memory of 2796	2364	rundll32.exe	33
PID 2364 wrote to memory of 2796	2364	rundll32.exe	33
PID 2364 wrote to memory of 2796	2364	rundll32.exe	33
PID 2364 wrote to memory of 2796	2364	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\cs.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
799dcf65f8c9d828c0c16f0696384941

SHA1
79562c27b6cff618c11223462905f17190e24edc

SHA256
e1aa4c6e4515aba1374a81b9440d18305312b3ca7a4d30c49008e4928a7dece0

SHA512
8f7177f9ddc3953a1ab15cd9cb5b007d1656c37a89e74b5f1c6316004908b7e51207cfaf5d44832140ce7cb6733e8af9a0d8e824a501997c0c3bb04030631901

Download Submit