6d7f1b46227593ce58ce2eac041a23e90f9fa45b2d609f17b1ac0cef8959ed0b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.reloc
Size

4KB
MD5

b84630f1a7f6e191bc7b4dcce9a83b70
SHA1

b707e635655ccaecc859740009d63d95b29959ff
SHA256

4d8bed210be2dca40a53c61cd8d856f5664229fe108907d419089b7244aa34f6
SHA512

819030a1ec626aa98caf2acd95f9b1be0f4841e51e4a28a19ec717575ad8b69632ac339017ce8e1948e086163bf3113b4fbc6d3b4d277f9d7e2c80dbba6aca1d

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2276	AcroRd32.exe
2276	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3020	2304	cmd.exe	31
PID 2304 wrote to memory of 3020	2304	cmd.exe	31
PID 2304 wrote to memory of 3020	2304	cmd.exe	31
PID 3020 wrote to memory of 2276	3020	rundll32.exe	33
PID 3020 wrote to memory of 2276	3020	rundll32.exe	33
PID 3020 wrote to memory of 2276	3020	rundll32.exe	33
PID 3020 wrote to memory of 2276	3020	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.reloc
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.reloc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.reloc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0535aca392a4333f966e9110eafd7d60

SHA1
6708aadaa4debaa043b56120a927ee67074de8b1

SHA256
6c908c76a48df535286cbede46f70d7415e86b173619f8c44465d4b0e9352865

SHA512
d1ac29bb6c299e2e9739756c556393be0b503a513cfd9852f134f9088e03f1b37a50bb8c5d2e06f656e7703fdc7385a4ac65022b1e6451acd24f11daaf577bf3

Download Submit