b7f2ab5eb7881baa91f5bc72ade2544cedfec11c6a9d74b8ed64c9cd59065268

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Boostrapper/Web.UI.View/locales/es.pak
Size

367KB
MD5

c8086dc25cf0a3c978b2c3b37edf8d67
SHA1

7b6d2ce8b3cc5a33ab2bcd23114fe65ccc568e7a
SHA256

11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b
SHA512

230e6999a6fea1df3b2708eb331a2c25ca53677b3453745ff9cc7fbbc013b69148af5609166720255a2db7e63b25e2d0c599fb07057a6b47bf61f63ea9db9e01
SSDEEP

6144:OYkS2J1Bc2UoWCfgfr56ZLb5R7q5zrB7bUlo4AN6PZmz:OYl2XWn5r0pFRm5zreloXnz

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2744	3016	cmd.exe	32
PID 3016 wrote to memory of 2744	3016	cmd.exe	32
PID 3016 wrote to memory of 2744	3016	cmd.exe	32
PID 2744 wrote to memory of 2756	2744	rundll32.exe	33
PID 2744 wrote to memory of 2756	2744	rundll32.exe	33
PID 2744 wrote to memory of 2756	2744	rundll32.exe	33
PID 2744 wrote to memory of 2756	2744	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\locales\es.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\locales\es.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\locales\es.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d52ce6f3cd9adf69f755c8674b0229f2

SHA1
6763e40d7a9a1a6fcbedc7322fdb94d0a28c8fad

SHA256
739919f86b33ee68e705b0ceb88eef5b8239515808119f6be233b1dc27358522

SHA512
9708dd897661b31749933a7dcd687931b4ce96058a1789d23f9d9c0943c9e2595725805ec1ae28814b868fb6ecd59f3f97d2bf4165fd4129051e2b03f7c692f1

Download Submit