0de54ccd8146146f7b7b5e92885b919779e2e923b2a12319f258d2e32d7777cd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geode.pdb
Size

32.9MB
MD5

2dae590c12613060bb61c346bdae872c
SHA1

6cf1a53e4240bd6164050c8233e1fd283b1b6594
SHA256

59f5f1e6f3e5f73462c51db3a0de84eda5778dbd752f89d4d3b7da7333bd7ddb
SHA512

6682925225212e55ac4fb9885a5fad5d7c2965f07fc74979a52513ba6a11dad57fe37a1063a5ab8a57dcf21dbd243687ad6e9c6101d3fe4c1401a6ed0dff493d
SSDEEP

196608:yg1eEXEBUnT9mSINUQXgu6AkOm/uAuAyjh7HevlLGmz3qsn47l8NT7lm7IRR:YK47l+mSR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1168	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1168	AcroRd32.exe
1168	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3008	1972	cmd.exe	29
PID 1972 wrote to memory of 3008	1972	cmd.exe	29
PID 1972 wrote to memory of 3008	1972	cmd.exe	29
PID 3008 wrote to memory of 1168	3008	rundll32.exe	30
PID 3008 wrote to memory of 1168	3008	rundll32.exe	30
PID 3008 wrote to memory of 1168	3008	rundll32.exe	30
PID 3008 wrote to memory of 1168	3008	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Geode.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Geode.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Geode.pdb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b90730595f6828bf1dc39dd82f0322fc

SHA1
950b9750a61ec3e43720c37f1572e8c323e71d51

SHA256
099186d742db3292ee8548f1454fc1b75bd32d6b1f6a6cfab95503807a4a3b0c

SHA512
4e27241cdf6f57751514903b27114d15ee71b4f628aaa88037570aa2489114a92db618b488bc0af61a6e02466b5577228229e7013add4f2aa3c1adf68d77a28c

Download Submit