aee777ead4791c2d6a5420b0625e7fdea13f6d84dedcaff924a5845df5f4db94

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PingCastle.pdb
Size

2.8MB
MD5

8043e887074434e6516b4c524f582821
SHA1

a9f85694140148ca1f4a6288c678dbbf4c13c5dd
SHA256

abdf1b3c68f3d2933e08e6138357cc1f921246cc4a20801511188e6598731084
SHA512

fa00495c221a0ce8a2a72384dfaa74c751e936eb048b0eaf0bb99ded5e839cc00ceeac0fe60b7810528caebd52f69398348cf313ea860d8416f88d4781dda30c
SSDEEP

12288:tZDF1+TYvuvJU0axYFSlB4R5WWuWb58sZ2Gj2LBNF4PtJb13372HwbOHhn/Hg4up:t5TtKBaxYFSb05AVBNF41Jbx2yOH5/S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2896	2976	cmd.exe	29
PID 2976 wrote to memory of 2896	2976	cmd.exe	29
PID 2976 wrote to memory of 2896	2976	cmd.exe	29
PID 2896 wrote to memory of 2720	2896	rundll32.exe	30
PID 2896 wrote to memory of 2720	2896	rundll32.exe	30
PID 2896 wrote to memory of 2720	2896	rundll32.exe	30
PID 2896 wrote to memory of 2720	2896	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PingCastle.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PingCastle.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PingCastle.pdb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
82fdeaf8ed2e38fd6273767791014110

SHA1
6b6b2835524adbd0ff83bc8ee550a7d214470372

SHA256
d272473890813485cee759087e47c0ac880a0ddee765c06818ce769e091a5488

SHA512
20421bec5896c910ca9f51c8573a72d565e366d82734f1129295004ac57d8368d34fe54a949e6e93793d010eeed159ac18397be4801a1ceb289a81808227bc9b

Download Submit