0de54ccd8146146f7b7b5e92885b919779e2e923b2a12319f258d2e32d7777cd

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geode.pdb
Size

32.9MB
MD5

2dae590c12613060bb61c346bdae872c
SHA1

6cf1a53e4240bd6164050c8233e1fd283b1b6594
SHA256

59f5f1e6f3e5f73462c51db3a0de84eda5778dbd752f89d4d3b7da7333bd7ddb
SHA512

6682925225212e55ac4fb9885a5fad5d7c2965f07fc74979a52513ba6a11dad57fe37a1063a5ab8a57dcf21dbd243687ad6e9c6101d3fe4c1401a6ed0dff493d
SSDEEP

196608:yg1eEXEBUnT9mSINUQXgu6AkOm/uAuAyjh7HevlLGmz3qsn47l8NT7lm7IRR:YK47l+mSR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2968 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2968 AcroRd32.exe
2968 AcroRd32.exe

pid	process
2968	AcroRd32.exe

pid	process
2968	AcroRd32.exe
2968	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2988 wrote to memory of 2900	2988	cmd.exe	rundll32.exe
PID 2988 wrote to memory of 2900	2988	cmd.exe	rundll32.exe
PID 2988 wrote to memory of 2900	2988	cmd.exe	rundll32.exe
PID 2900 wrote to memory of 2968	2900	rundll32.exe	AcroRd32.exe
PID 2900 wrote to memory of 2968	2900	rundll32.exe	AcroRd32.exe
PID 2900 wrote to memory of 2968	2900	rundll32.exe	AcroRd32.exe
PID 2900 wrote to memory of 2968	2900	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Geode.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Geode.pdb
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Geode.pdb"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
20762c5c14ae05a6bda30a35b8293f9a

SHA1
f68f6b35f8c5fd6b350b13a6f28261e8c7732a75

SHA256
00f406d5b9c6baf6f480dd3a178058c5168a9003cc3c0402ddf5e432a111cef6

SHA512
cc249aa89227a5447ee15e36f20aaa029b4b90638f656eea3e7deae07457d41ebf25317f13a4b51eadb88035db991c2e7246b157c07b9ea453a6c177662df7eb

Download Submit