df135707402bd01bc6a3c10d16f876f25bd16b8a85329687833490cebd9b0051

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/03/2023, 16:50

Target

AdobePIM.dll
Size

1.9MB
MD5

45ff5483f7dbd3c2aa634f8aab99e48c
SHA1

af1b51e06c2bbfa4a76f669878c34046ae43fef2
SHA256

b10756942a010d67ae7d01fe759d9e94261d2f93cdf7bdb971fc78c146d0674a
SHA512

6d12d300a8c241901cd6c9ccf358f0befb9796262afe7ad0bbda6374d7b22c44cfbfba2065182fc0d55b61521c1d65bfcf76c4404ae17fa8f4aadd7f3e752c21
SSDEEP

49152:nn/9QcAxBaL4BatLmCGbD6AJYt2yx1ZIB0FzwPij0r/gHfjrZCzqOUCEdKq145Xk:FAaL4BatLmCGbD6AJYt2yx1ZIB0FzwP6

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db-journal	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27
PID 1324 wrote to memory of 1196	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#1
  2⤵
  - Drops file in Program Files directory
  PID:1196

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact