229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.5/PvZ_Tools_v2.7.5.exe.hash
Size

315B
MD5

c3765a3d4fec80757c646dfd58b77ef6
SHA1

10b9cd1a2079fbfa95fc65622e3eae3bd65afba2
SHA256

d0214e244123f4b296377e5d5154841df27c085835c719b16f3a9e62f0d6df98
SHA512

ac6ef5858efbfc340263451baaf7f6f25c6a14533b09d023c5232b56b235f466995c87c35b2f1e3c4c872eb6fa22441f4d29662fbeb411650b931a62df59334d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.hash\ = "hash_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\hash_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.hash	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2784	1044	cmd.exe	29
PID 1044 wrote to memory of 2784	1044	cmd.exe	29
PID 1044 wrote to memory of 2784	1044	cmd.exe	29
PID 2784 wrote to memory of 2656	2784	rundll32.exe	30
PID 2784 wrote to memory of 2656	2784	rundll32.exe	30
PID 2784 wrote to memory of 2656	2784	rundll32.exe	30
PID 2784 wrote to memory of 2656	2784	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.hash
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.hash
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\PvZ_Tools_v2.7.5.exe.hash"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
699bdecce5e0b431c4c70d612d504fb0

SHA1
356c8fad6a68ed414b53d84f2117ad32dfc60d13

SHA256
40b891996a8a22cc2973a9641c710fafe21bd0faa463ec47683fa0c75a06ced8

SHA512
f5d8f9c8494ecacef78696c596c7e85c74efea33e21310f65f867d084551efc9746329da663e526af6722fe7d98651717eb2ecead8991f8da59fedced32b3a85

Download Submit