abf685e78562fa3aee73f00110685c5c7340ede3acb6fcda88ba25ad85a4b180

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

custom_Suiika_V1_03/Custom_Suiika_V1_03_4k/Expressions/Hairband.exp3.json
Size

164B
MD5

ae07f8ed2873523d8437256ef99f4b79
SHA1

aa8bdbc9629690b68d7564770d7595d3f483b3ed
SHA256

b8a60549ede5563c37772407ecc84b0ae5dc5146bea1279d68e328fa6de6176e
SHA512

5e18bdb9fbba1f72007033a140c24ed716792215db84bc7d177cefd611514419c65370de8925fe60b69b56b5ba5022329a60a5a56e3f19af470ea3428531d070

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2860	2788	cmd.exe	31
PID 2788 wrote to memory of 2860	2788	cmd.exe	31
PID 2788 wrote to memory of 2860	2788	cmd.exe	31
PID 2860 wrote to memory of 2772	2860	rundll32.exe	33
PID 2860 wrote to memory of 2772	2860	rundll32.exe	33
PID 2860 wrote to memory of 2772	2860	rundll32.exe	33
PID 2860 wrote to memory of 2772	2860	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Hairband.exp3.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Hairband.exp3.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Hairband.exp3.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
531726bdbaf3c4038e507d16887cf7b2

SHA1
aa4682dd7df34ef3f423b39730d3038737243089

SHA256
76e72e1bd7d51434beb34ee25b9f81ad193383c6ae499804ed69beadab1a54a2

SHA512
924060c4ce39781e1283313257e2ac3bcff3e56be583d634e9539b5576ce866530630137975229bc24d717d42ee1e2c92ed91f494c0c881e836db85c94324e9e

Download Submit