644372d31b62c327439aefff7ae0d2d2b09cf8a9963c4d10408731358c1ce879

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/vi.pak
Size

476KB
MD5

9274866d7c6314f43dd63ed293293e25
SHA1

4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256

dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512

3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e
SSDEEP

12288:JqiJKHugsHBM0P5ZwSQ3cXzIJ1758/UIi0+UG3Lzi8Tal:eugsHe0PTwSmezE5Iti0+UKfi8Tal

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2668 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2668 AcroRd32.exe
2668 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

pid	process
2668	AcroRd32.exe

pid	process
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2108	1996	cmd.exe	rundll32.exe
PID 1996 wrote to memory of 2108	1996	cmd.exe	rundll32.exe
PID 1996 wrote to memory of 2108	1996	cmd.exe	rundll32.exe
PID 2108 wrote to memory of 2668	2108	rundll32.exe	AcroRd32.exe
PID 2108 wrote to memory of 2668	2108	rundll32.exe	AcroRd32.exe
PID 2108 wrote to memory of 2668	2108	rundll32.exe	AcroRd32.exe
PID 2108 wrote to memory of 2668	2108	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\vi.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\vi.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\vi.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0ad930668f340020c8cb9e1d5e4e7995

SHA1
7f80b096a9a4d4a481210d228876c425b7bf077a

SHA256
5fcfd3bb0533f6accf902b6ed1fce05da5f3e6335ea6c5133b1be4ef56085a50

SHA512
bb68133e5b210710aad8f41ab431dffa4366a1983f4baf58f17d44903f9ed3d09bd39946c05a6be05fe9fa63fa84cffc98609a3b14a4ba7dce43529630a24032

Download Submit