b7f2ab5eb7881baa91f5bc72ade2544cedfec11c6a9d74b8ed64c9cd59065268

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Boostrapper/Web.UI.View/am.pak
Size

531KB
MD5

e8bac983607c5432f789afdacdda42ac
SHA1

95c26f47f7102be338263fd7f7e365632651f22e
SHA256

ee363b88697a26d486c77bbf05f5f7f62d4b40c235e1d85e11448083070576f7
SHA512

5e26f40c8dc088d21b9b6a01041ece3bd4b2899ee33fdd85be995545c7a24860fdc9c672da8c9345a08891e0bac04ccf4d65de543f4cfba0bab0ae3fb32354c7
SSDEEP

12288:GguzxX8xfzKsEYg95z9SBeuUPQvx30jH8+I:GX8xfzKnYg95z9SBoPQr

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2864	2188	cmd.exe	32
PID 2188 wrote to memory of 2864	2188	cmd.exe	32
PID 2188 wrote to memory of 2864	2188	cmd.exe	32
PID 2864 wrote to memory of 2892	2864	rundll32.exe	33
PID 2864 wrote to memory of 2892	2864	rundll32.exe	33
PID 2864 wrote to memory of 2892	2864	rundll32.exe	33
PID 2864 wrote to memory of 2892	2864	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\am.pak
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\am.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Boostrapper\Web.UI.View\am.pak"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fd22c7ff4d875bbb4a94907584dd0d6b

SHA1
7858fb91d77794cb06edc5d4711a235aa8b43250

SHA256
99621d233e411e022968e787d91210750571612bb1713ea79b1e79c2f4737520

SHA512
e6877ab3a529ce9dff93205c7e95dc0e85fe2e1922947b6e370c1c003c19cf5ddac42a1f79e1825d2d7e0b8ac6930fbc0ba9a07ab558e4f6a865d195f20a2db6

Download Submit