726801fad2c96a1d667a37d9afe68dbc60105274088595959d483273daa18446

Analysis

max time kernel
46s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 09:35

Target

PS3 Avatar Tool by x22/Avatar PSN Tools.runtimeconfig.json
Size

154B
MD5

42cfea46ed97e8dbbd7bd335329ec2ac
SHA1

c4861e68c17b69f8beffb68d9198c5b49d15da9a
SHA256

3620d53dc87b4aa2cbd50b5ca80baa3e3a017d9d38cb72f690e44295afc33f77
SHA512

51d132a2ec34ba11b4a806870e7955b8bc5caea9e783a38918859cf8fa988552bd40fb6c71e21cacf8e7164d5ce12f2a5665f990f58ef99527bde8dffc1b5a2b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2576 AcroRd32.exe
2576 AcroRd32.exe

pid	process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2932 wrote to memory of 2592	2932	cmd.exe	rundll32.exe
PID 2932 wrote to memory of 2592	2932	cmd.exe	rundll32.exe
PID 2932 wrote to memory of 2592	2932	cmd.exe	rundll32.exe
PID 2592 wrote to memory of 2576	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2576	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2576	2592	rundll32.exe	AcroRd32.exe
PID 2592 wrote to memory of 2576	2592	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PS3 Avatar Tool by x22\Avatar PSN Tools.runtimeconfig.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PS3 Avatar Tool by x22\Avatar PSN Tools.runtimeconfig.json"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2576

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
62051bde0d93da255865160a138b643e

SHA1
ed50bcaa6dfcb6bac8a0be36b9fb7218302b6e5f

SHA256
689a757ba65b61c8f2d795105b08c0e02ad52061fc210811b22c34f52fae0f34

SHA512
44f1aad195405697601a3a5b8caa9f1eae4a072dd7982af7c2f0c0999616275cad7eeafb7ebb58f4d6e093a209838983a6a09bdc2412e74b418d65c45dc8a397

Download Submit