ea881853f35b6971f49332c5d66e7388b8598e5ac5a0bca24826bc08f22bd4c9

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

chrome_200_percent.pak
Size

222KB
MD5

3969308aae1dc1c2105bbd25901bcd01
SHA1

a32f3c8341944da75e3eed5ef30602a98ec75b48
SHA256

20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
SHA512

f81ed1890b46f7d9f6096b9ef5daab5b21788952efb5c4dcd6b8fd43e4673a91607c748f31434c84a180d943928d83928037058493e7e9b48c3de1fc8025df7f
SSDEEP

6144:HDQYajN6svyABnI86uKkxugx5GMRejnbdZnVE6YoppO4:sfjN6svyABTKkxa6edhVELoXO4

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2712	1072	cmd.exe	31
PID 1072 wrote to memory of 2712	1072	cmd.exe	31
PID 1072 wrote to memory of 2712	1072	cmd.exe	31
PID 2712 wrote to memory of 2608	2712	rundll32.exe	32
PID 2712 wrote to memory of 2608	2712	rundll32.exe	32
PID 2712 wrote to memory of 2608	2712	rundll32.exe	32
PID 2712 wrote to memory of 2608	2712	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\chrome_200_percent.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
61a149892d9be2c63004d529a96b679c

SHA1
bcb1f149c58ec80db3d6262fc2f268e29a7d3fca

SHA256
39e47bf37f73597efeb52e0551293316cffbafd054055f07fd262c0cb2ab697b

SHA512
b397bb0a3cf305a0eaac18705549efb8174a5a1e2527146b7983fca4c9dbe4e2ade3d6d96294d0a9cbd5b1f66af1ae9b6f45555ba067b3729b10d2b1b0923906

Download Submit