e3596428cd648a2b0374346a990e71cf4af0feb6bb6ec51d8ec3e369f26e2bbe

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geode.pdb
Size

36.5MB
MD5

3da0c10b996438a6de7e01c093b41b19
SHA1

9c069a25026a15971928a06d1a22ecfc5ab14191
SHA256

eb002b99f1467813462341538d5feb927be68e03075ad81ddf495611c2ce0123
SHA512

6c49130cc3c04d349a032f122c80b395a504af01a24c8398aa379f4b5b6aecc855bc1bed31a8d6d2093253543a986638eb34ea7e8f6898adddcdabafe6056997
SSDEEP

196608:O3NAz/vHuRqfdfTXVZ3O533dh3kyrgrYdh1495Hc:O3NAz/vHu0fdfBZ3S3X1rgrYdMm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pdb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pdb_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2856	1700	cmd.exe	29
PID 1700 wrote to memory of 2856	1700	cmd.exe	29
PID 1700 wrote to memory of 2856	1700	cmd.exe	29
PID 2856 wrote to memory of 2648	2856	rundll32.exe	30
PID 2856 wrote to memory of 2648	2856	rundll32.exe	30
PID 2856 wrote to memory of 2648	2856	rundll32.exe	30
PID 2856 wrote to memory of 2648	2856	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Geode.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Geode.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Geode.pdb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
474219a7ea351f3665a10e42cd7bc34a

SHA1
aaf04691aaa4825f947e0978a364d8776c582039

SHA256
dae3e31bf925c2f9b51bb75ec22b0341c645eccaf3c442637b8ff89d7002915f

SHA512
94737152b88c1bd375ac3d9ee2d0cb41b55609c29e9e44e137824faafdf4ffa6d60781a2cf1dcbe1abb3f989c90c2d46bff00c4bbdc290ff73d9074934f7cb8b

Download Submit