Analysis
-
max time kernel
63s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 21:40
Behavioral task
behavioral1
Sample
Аdоbе Рrеmiеrе Рrо 2024.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Аdоbе Рrеmiеrе Рrо 2024.exe
Resource
win10v2004-20240426-en
General
-
Target
Аdоbе Рrеmiеrе Рrо 2024.exe
-
Size
105.0MB
-
MD5
9b18532674a9282289f8be8357460eb4
-
SHA1
3ab80df6fd12ee818b0efa62547a255689b56b89
-
SHA256
37e5d18fe89aa21253fc6b82f73ca1938b4f86f63a4c6686ff85471d6d88a082
-
SHA512
f0c99375a23c72573d8d74fa8acfc27b2dc690579fac4ee919c72a14e043bb0b7ab9295c937d36064c7a80a69c1a64d7af13dc750cf70af4fdba4ca60f527c0d
-
SSDEEP
1572864:gDJaiqXk6kYbEzJI7TWYiLWuPX9prFxCr8wkhXGeC37spBnwjWfm2Tivq:Ab9YbEVQqLWuPXD+r/khXGezBnaW+vq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Аdоbе Рrеmiеrе Рrо 2024.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Аdоbе Рrеmiеrе Рrо 2024.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2312-1-0x0000000000E80000-0x0000000001E80000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2732 2312 WerFault.exe Аdоbе Рrеmiеrе Рrо 2024.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Аdоbе Рrеmiеrе Рrо 2024.exedescription pid process Token: SeDebugPrivilege 2312 Аdоbе Рrеmiеrе Рrо 2024.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Аdоbе Рrеmiеrе Рrо 2024.exe"C:\Users\Admin\AppData\Local\Temp\Аdоbе Рrеmiеrе Рrо 2024.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 21242⤵
- Program crash
PID:2732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2312 -ip 23121⤵PID:5016
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2312-0-0x00000000747CE000-0x00000000747CF000-memory.dmpFilesize
4KB
-
memory/2312-1-0x0000000000E80000-0x0000000001E80000-memory.dmpFilesize
16.0MB
-
memory/2312-2-0x000000000C140000-0x000000000C1A6000-memory.dmpFilesize
408KB
-
memory/2312-3-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/2312-4-0x0000000030D60000-0x0000000031D60000-memory.dmpFilesize
16.0MB
-
memory/2312-5-0x000000000BB20000-0x000000000BB46000-memory.dmpFilesize
152KB
-
memory/2312-6-0x0000000013960000-0x00000000139D6000-memory.dmpFilesize
472KB
-
memory/2312-7-0x000000000D0A0000-0x000000000D0AA000-memory.dmpFilesize
40KB
-
memory/2312-8-0x000000000D120000-0x000000000D13E000-memory.dmpFilesize
120KB
-
memory/2312-18-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB