bc6612f74ffa0035fa08e062880dae1e38305c7c22fab3619b7c638e0cb66528

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/cs.pak
Size

425KB
MD5

a934431d469d19a274243f88bb5ac6fb
SHA1

146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256

51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512

562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d
SSDEEP

6144:U4Wm4h8qE2jv7SxUjBA59wjR558YAGKND9Gto8QV:U4WlvE2jjSxqywjR558YAbNDcI

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2188	AcroRd32.exe
2188	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2160	2516	cmd.exe	32
PID 2516 wrote to memory of 2160	2516	cmd.exe	32
PID 2516 wrote to memory of 2160	2516	cmd.exe	32
PID 2160 wrote to memory of 2188	2160	rundll32.exe	33
PID 2160 wrote to memory of 2188	2160	rundll32.exe	33
PID 2160 wrote to memory of 2188	2160	rundll32.exe	33
PID 2160 wrote to memory of 2188	2160	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\cs.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\cs.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
026a2f7eefa077c2b299fbb3f7f59e0c

SHA1
8c2e5dfd4810269354c4aca1524c3b51385c570b

SHA256
c2ce21a312cc840632afc7ed58f05f19d5c5ed781ad959692adc974d88f7359d

SHA512
3025cfca0106aa3be9f7e2d9576733b942f3e1383a8fe226def49dd3f864a412fc538040dee2ef0a566fd09fb777eb5d65795ef86bc9411d58b0093fd1d9df21

Download Submit