bc6612f74ffa0035fa08e062880dae1e38305c7c22fab3619b7c638e0cb66528

Analysis

max time kernel
102s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ar.pak
Size

655KB
MD5

56f6dc44cc50fc98314d0f88fcc2a962
SHA1

b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256

7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512

594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e
SSDEEP

12288:2wnA/ktqm99pX8vYUxXrmhkH+95NNb++YTzgpPMgSENIg:XACPfuq5S+L

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
580	AcroRd32.exe
580	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2920	2300	cmd.exe	31
PID 2300 wrote to memory of 2920	2300	cmd.exe	31
PID 2300 wrote to memory of 2920	2300	cmd.exe	31
PID 2920 wrote to memory of 580	2920	rundll32.exe	32
PID 2920 wrote to memory of 580	2920	rundll32.exe	32
PID 2920 wrote to memory of 580	2920	rundll32.exe	32
PID 2920 wrote to memory of 580	2920	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ar.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b20d1342fffa7cdff26459dcb2a58d9

SHA1
b81426a4c6278ec009b62ed972e614efa469337e

SHA256
e4a0ad71d8ac6e3ce1d0ec902781e5dd9f97a1ec9cc03d2d1d58ebe54ac2877f

SHA512
37f5f16ceab237603b4e82a355f7675ed06239e9af208e0ce9b1df1b9d94f4ba562434e0682d619d07eac18b54498de327df17a5b935e796ffa6b8c68c455554

Download Submit