abf685e78562fa3aee73f00110685c5c7340ede3acb6fcda88ba25ad85a4b180

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

custom_Suiika_V1_03/Custom_Suiika_V1_03_4k/Expressions/Over Body Sideswept Twintail.exp3.json
Size

1KB
MD5

360268331188d269d07345a2173c8141
SHA1

30bb08d8482ca6596ab59cdc48d13525a4cc7887
SHA256

aaa448ca529e37e7c8bb1ec0a0ca8a3d12234e038b31cdbbf1e3d1202a10a90c
SHA512

54afcb11450f4007ccd6e286e2080dab9c4fe65e44e5ce711ec1db1b254249a48d8ff592039a189e3c0cd9fd6fe5c28515968d1678326a03177d068f8591e487

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2120	2384	cmd.exe	31
PID 2384 wrote to memory of 2120	2384	cmd.exe	31
PID 2384 wrote to memory of 2120	2384	cmd.exe	31
PID 2120 wrote to memory of 2720	2120	rundll32.exe	32
PID 2120 wrote to memory of 2720	2120	rundll32.exe	32
PID 2120 wrote to memory of 2720	2120	rundll32.exe	32
PID 2120 wrote to memory of 2720	2120	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Over Body Sideswept Twintail.exp3.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Over Body Sideswept Twintail.exp3.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\custom_Suiika_V1_03\Custom_Suiika_V1_03_4k\Expressions\Over Body Sideswept Twintail.exp3.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7aedbc167f3ea41770fa0a36fe4e0338

SHA1
4b90c63adad68bdf206261b5409c5689ef576516

SHA256
9dc882c0e26bea7a3bf553ad74cc65bf687cb2084a205708d67281552fcc2eda

SHA512
a0d2495c50527b911fb2589adb9fc4fbff9a2dfd55ada90d01ec0fb6e01302010b73262b6b26d48b4014c4182e46b2f2ea62e81d2dfc83876614f67422ea5d68

Download Submit