229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.5/PvZ_Tools_v2.7.5.exe.asc
Size

833B
MD5

f13affaf284590d2ab6012544b428093
SHA1

338bd9c2ea3ed6d4093e1b0a015bc527bdbc1dda
SHA256

81a3db09daa8cf32efd0edc0a338e82846dab54998e0a2e37935c42c6acf099f
SHA512

306e5a6e53bab21f9b8fffef168b316f87d3e9f71289f67126117bda6dd6ae300469bb0cc0a695af9dd934ce2a841a0500f57f660a1cc38ec497219c8de918f4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.asc\ = "asc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.asc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\asc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	AcroRd32.exe
2764	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2888	2372	cmd.exe	29
PID 2372 wrote to memory of 2888	2372	cmd.exe	29
PID 2372 wrote to memory of 2888	2372	cmd.exe	29
PID 2888 wrote to memory of 2764	2888	rundll32.exe	30
PID 2888 wrote to memory of 2764	2888	rundll32.exe	30
PID 2888 wrote to memory of 2764	2888	rundll32.exe	30
PID 2888 wrote to memory of 2764	2888	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.asc
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.asc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.asc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3819ac63392b4e5d1b260d291a378807

SHA1
716cf6d1a9c1935f5acddb2a083ede40e9b5739d

SHA256
ec4ac423958ba121d3d070ce5ebcdb19e489fda935d436f49225bab78086b5d5

SHA512
d1938067a4892fe9639ee88d97dbb13a11e4f27ea2bac9db795ec4f3bd6fd361b9d3a08f3f099be526cd9006d45e5bef52d613880e5985feb8bd554aad22c960

Download Submit