27ee4f0a1d40a5794fefcbc800501248070e8438014cc39515fdb938518b52dc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PVZ-Zombies Domination V1.3.1/compiled/particles/BossExplosion.xml.compiled
Size

650B
MD5

773cdf038a6f551d11cc93cc0e6c60ab
SHA1

7f1b6063aff238e48f78f5d5e34deeacd23c3db2
SHA256

3e806b347760a260862fb0a907526548e0fd96340f7707b6bbdb3e8ed4243fed
SHA512

354b0395522e36b5b7dc55fbf97ba4c1bc1b68130e4a1d3ae011b41205dac32644c2ef2d6f17839a908e3e2a4da53429bdf1e2a6faa92497f8369089a7a497a1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.compiled\ = "compiled_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.compiled	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\compiled_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1924	AcroRd32.exe
1924	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2712	2992	cmd.exe	29
PID 2992 wrote to memory of 2712	2992	cmd.exe	29
PID 2992 wrote to memory of 2712	2992	cmd.exe	29
PID 2712 wrote to memory of 1924	2712	rundll32.exe	30
PID 2712 wrote to memory of 1924	2712	rundll32.exe	30
PID 2712 wrote to memory of 1924	2712	rundll32.exe	30
PID 2712 wrote to memory of 1924	2712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PVZ-Zombies Domination V1.3.1\compiled\particles\BossExplosion.xml.compiled"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PVZ-Zombies Domination V1.3.1\compiled\particles\BossExplosion.xml.compiled
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PVZ-Zombies Domination V1.3.1\compiled\particles\BossExplosion.xml.compiled"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
742e589dd02d2870e08eb692fb982015

SHA1
0365743f80f461c7afc6493f68a3533f1cab3635

SHA256
62585e52c90a3f918b797d46ee1eb6a764b7568e350473aaf6a841d553760095

SHA512
3b2b61cd107696084ad53b876a7d934d00775ac34f2e9cc7a01672264d6f66a3dc3d91a0c9fed1def9cae64db33db3dcac47f2d922278a9eae296d51ff151d2f

Download Submit