5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/Ookii.Dialogs.Wpf.pdb
Size

27KB
MD5

e9b456e2db3949a55841e5648a01525b
SHA1

d049df5b7773479aa30a0e6f067faa35bce26a85
SHA256

97c348afc7e56e7316b13aeb94b4ee5e6fd2164dd3033a94c37da5aa1a15f744
SHA512

e61943dad87f5669badd931d0a6be84582c308cf8881bc12ee4ceaf515dadf5bac88b50fc1f48e21b1a49854b1c9e3a65752adad97c1822a2b9250d8a94a5bbb
SSDEEP

384:edH+cRrFSmgWFIFuS0NS4L0qcaT+I5/WosGOFTdJBU2nxvRUucXzQzv87DxJYO3V:WeSrcFV0E4LTcCroF9v6RDQzSdaNXG

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	AcroRd32.exe
2192	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2492	804	cmd.exe	32
PID 804 wrote to memory of 2492	804	cmd.exe	32
PID 804 wrote to memory of 2492	804	cmd.exe	32
PID 2492 wrote to memory of 2192	2492	rundll32.exe	33
PID 2492 wrote to memory of 2192	2492	rundll32.exe	33
PID 2492 wrote to memory of 2192	2492	rundll32.exe	33
PID 2492 wrote to memory of 2192	2492	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Release\Ookii.Dialogs.Wpf.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Release\Ookii.Dialogs.Wpf.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Release\Ookii.Dialogs.Wpf.pdb"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d8ea0b4b28347fcd1cea5b48eaefb02

SHA1
9390fb856941e36c6aa75fcf23850a50011d30d3

SHA256
c07445933b500c6b35553e5986166ac94877112448b1fdf5e3e8e0f33e4924e1

SHA512
ff7b40d52ff0e3deda9c79e587393a8d78689b2f46db651acd35c9d8d689b519bda8375eea311c398f980ba8f9339ed71d26ab3fb86f068f4ba58d73b66f7c85

Download Submit