670c3c11677386167bdc685d2a25a97751ffef4c89ddacc230af2d7021b8200b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

net8.0/Spoofer Base.pdb
Size

20KB
MD5

174e77cfc78a7739e9390e60a42b7df6
SHA1

09c631f93d1f57d2436ae45bfeaa63da410180fe
SHA256

d7e7e6995d2c7cf8a1e68b1afad7d158aa13ccd4b039401d12483cdd21b02b00
SHA512

188e692afbe59001565d72ba5c0da11a0f7376cdd3725e8d871d5e4acc17d2ef492a7159a0ecd2f60c7ddd232508252dc82278161fa916ae2c870440f2388446
SSDEEP

384:3fPXNuxl4mH3zIdEX+A60a09v2osSHZ/j1wMbaBkJMgtcpXrfH8f6Awb3LjmuckO:3fPUl4mXzIdH6LbaBkSg2DNtFMiX/EL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1572	AcroRd32.exe
1572	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2276	2164	cmd.exe	29
PID 2164 wrote to memory of 2276	2164	cmd.exe	29
PID 2164 wrote to memory of 2276	2164	cmd.exe	29
PID 2276 wrote to memory of 1572	2276	rundll32.exe	30
PID 2276 wrote to memory of 1572	2276	rundll32.exe	30
PID 2276 wrote to memory of 1572	2276	rundll32.exe	30
PID 2276 wrote to memory of 1572	2276	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.pdb"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\net8.0\Spoofer Base.pdb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3195362f7c8e1e7d5abddbfbb1aade8d

SHA1
22bb8e7fa3d2dee95c5ee9634eff097e4486fd6b

SHA256
c00a7591979c6250b01b9175b3c3092fdf5d8cfe129b250aef6f842eb3d341bb

SHA512
bf47b00bf61e585bde8d4dfc9d33f3b4b878f60dc0af6debfd047282236b48443f2ebf5c7ec1be963a0171d9db1b5d8ffeb8038671164d5c8549371e22b60e08

Download Submit