644372d31b62c327439aefff7ae0d2d2b09cf8a9963c4d10408731358c1ce879

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ta.pak
Size

1019KB
MD5

a8beab6896018a6d37f9b2e5bdd7a78c
SHA1

64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256

c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512

73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5
SSDEEP

6144:LXNxfybLQ4iFd2n1E+1lhfi5yzntRMcA2i:rffyblEd21Z13i5yzMcA2i

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	Process	procid_target
PID 2464 wrote to memory of 2316	2464	cmd.exe	31
PID 2464 wrote to memory of 2316	2464	cmd.exe	31
PID 2464 wrote to memory of 2316	2464	cmd.exe	31
PID 2316 wrote to memory of 2320	2316	rundll32.exe	33
PID 2316 wrote to memory of 2320	2316	rundll32.exe	33
PID 2316 wrote to memory of 2320	2316	rundll32.exe	33
PID 2316 wrote to memory of 2320	2316	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ta.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ta.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ta.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b52c9602d095f3e60a788134a06eeb39

SHA1
88f2da7688ab1101794e143e81d36ade8127d7af

SHA256
d656b43100b3a75ca499e5d0812ce438274d83af805d513a7e015e20b0729a27

SHA512
d9f546ed3ac9004baeb1d697d9cd6576ec309e7aa3b22a886166aeeef500185424d61c62450f82ced6f61cae967a3ef4b352e96dad6698c26df0e27823b7ce72

Download Submit