fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Analysis

max time kernel
837s
max time network
850s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/03/2025, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/REPO_Data/globalgamemanagers.assets
Size

368KB
MD5

57a1602d7a9e7751bb16c35b2ce13e5d
SHA1

9f7d83e74fbdc682be9ea23a5b70b38e47494d44
SHA256

e90724df8266ac4fb3d79805d4379f42e624e6711d432220c15dcce2d242a235
SHA512

6f9724896f068118c4830bfd598e950d70caba41b0586398fe73078ae4b0c638ed1e6c25869dbc14daf3fe2e9989ed87199a72902ddda4b041c56efbc19df855
SSDEEP

3072:B3k7lUPNDzYwhI4kyVVaKilnXgiGh0zwk2YzXBTfMaEg5SwRUDY:BUs/YIkyVVAXTG+wk2ANMlg5SwRUDY

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	AcroRd32.exe
2560	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2796	2756	cmd.exe	31
PID 2756 wrote to memory of 2796	2756	cmd.exe	31
PID 2756 wrote to memory of 2796	2756	cmd.exe	31
PID 2796 wrote to memory of 2560	2796	rundll32.exe	32
PID 2796 wrote to memory of 2560	2796	rundll32.exe	32
PID 2796 wrote to memory of 2560	2796	rundll32.exe	32
PID 2796 wrote to memory of 2560	2796	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\R.E.P.O\REPO_Data\globalgamemanagers.assets
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\REPO_Data\globalgamemanagers.assets
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\R.E.P.O\REPO_Data\globalgamemanagers.assets"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d302f84d3b5a953e81296a219bf168c3

SHA1
7b343f14fd8f49a7aa475aa978b6349abe750abf

SHA256
b012edc56bc1a5ce86f6a81c789ada6a94b0dac4ae622697d3d8dbfe658846da

SHA512
deac11475c451f13e2cb9ad152c4a7ff02ef624a0e5393f8e72c7a84b7a5e39d0d61f08ddc8150573a1fb096c7995b0535bf8593a9f81e047eb124298973997a

Download Submit