8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ruler.Engine.pdb
Size

11KB
MD5

52eb1dfa65939c3afb8c27d4ee389d21
SHA1

7bfcef34645e9386491c0052bdf2f46dbb54a0c9
SHA256

f74ce0efa50ebf296f7c1f9969bd095724adcb82615139e6edff570f47bc14c4
SHA512

720ec6d9007c2f578c219a28bdd27ea4f01d310e772e3771986ae67a0c5bdf6544c567d0a912ecfa8f03e4572523690f22bb4ced6f91db4d4f01d960565bbe35
SSDEEP

192:4v9M+QfFaBL23Q3rp3EV9L9s9/9D9+nhMx0cXI16GhhEnaZl/zxXkmG4sc3dQ4or:4v9htaAl5M16GnaaZl/zxXkmGPcV3WkI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pdb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2892 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2892 AcroRd32.exe
2892 AcroRd32.exe

pid	process
2892	AcroRd32.exe

pid	process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2756 wrote to memory of 2636	2756	cmd.exe	rundll32.exe
PID 2636 wrote to memory of 2892	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 2892	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 2892	2636	rundll32.exe	AcroRd32.exe
PID 2636 wrote to memory of 2892	2636	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ff04fe9a25e038537d7bd2867c0738aa

SHA1
c05d769ea6aedc66bbfd1d6b670292e753ec4404

SHA256
7e57e279b38479e97496d7be1434e2d30e69ed8c277196ea73c6ec096964fa31

SHA512
4741c9140542dd19deb850c452eb787f3bef7a2f1ad54ad68cfc520a3397ff10d7ad5f566aec81aba8d7ae61ceca642ee05434ede6cfc21e71c3a0998628ff22

Download Submit