aa8ff4d4c4505f9245ae995be2fee8f6a78b1167126e613490e1c22549bdf142

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lang/sv-SE.json
Size

2KB
MD5

cad1a26d7bae3f9a70058011b6927b98
SHA1

4a3b1271596775539dd1d1ba406320e9c5fb7a9e
SHA256

32b68ce57f1ebd0d46b94f1ee6c09d8f31b9dd454b9e2cfa6e74f471de788e0f
SHA512

772bcfafa8397c3b0ab3796b04e8b1f054297033537b0726755f74192c135edb60111b2949b27b35fd6f25364711b4710617442088e6ca072bac940fc08baad1

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2748 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2748 AcroRd32.exe
2748 AcroRd32.exe

pid	process
2748	AcroRd32.exe

pid	process
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2140 wrote to memory of 2916	2140	cmd.exe	rundll32.exe
PID 2140 wrote to memory of 2916	2140	cmd.exe	rundll32.exe
PID 2140 wrote to memory of 2916	2140	cmd.exe	rundll32.exe
PID 2916 wrote to memory of 2748	2916	rundll32.exe	AcroRd32.exe
PID 2916 wrote to memory of 2748	2916	rundll32.exe	AcroRd32.exe
PID 2916 wrote to memory of 2748	2916	rundll32.exe	AcroRd32.exe
PID 2916 wrote to memory of 2748	2916	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lang\sv-SE.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lang\sv-SE.json
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2916

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lang\sv-SE.json"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e2475dbc547ec5a78c5d353200ca92e

SHA1
c6f9357d9240531681e0f9fe1d4a5fc7d7246307

SHA256
564786e2332a40fa7724c05612771b7f442c572c6f536e4cf79fa74bc8316145

SHA512
c208a14a0564e8a5eebab16523b6dc858a2eeece386f8d9f12c320bfe3a0d75f3f9b9917b73705f533d18df20cc15c242486e7de4b5a33d7a76b68b078020cf5

Download Submit