8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534

Analysis

max time kernel
104s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ruler.Engine.pdb
Size

11KB
MD5

52eb1dfa65939c3afb8c27d4ee389d21
SHA1

7bfcef34645e9386491c0052bdf2f46dbb54a0c9
SHA256

f74ce0efa50ebf296f7c1f9969bd095724adcb82615139e6edff570f47bc14c4
SHA512

720ec6d9007c2f578c219a28bdd27ea4f01d310e772e3771986ae67a0c5bdf6544c567d0a912ecfa8f03e4572523690f22bb4ced6f91db4d4f01d960565bbe35
SSDEEP

192:4v9M+QfFaBL23Q3rp3EV9L9s9/9D9+nhMx0cXI16GhhEnaZl/zxXkmG4sc3dQ4or:4v9htaAl5M16GnaaZl/zxXkmGPcV3WkI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pdb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3020 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

3020 AcroRd32.exe
3020 AcroRd32.exe

pid	process
3020	AcroRd32.exe

pid	process
3020	AcroRd32.exe
3020	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2268 wrote to memory of 2828	2268	cmd.exe	rundll32.exe
PID 2268 wrote to memory of 2828	2268	cmd.exe	rundll32.exe
PID 2268 wrote to memory of 2828	2268	cmd.exe	rundll32.exe
PID 2828 wrote to memory of 3020	2828	rundll32.exe	AcroRd32.exe
PID 2828 wrote to memory of 3020	2828	rundll32.exe	AcroRd32.exe
PID 2828 wrote to memory of 3020	2828	rundll32.exe	AcroRd32.exe
PID 2828 wrote to memory of 3020	2828	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ruler.Engine.pdb"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f3dd775f97558d2896dd72640ab89e3b

SHA1
5645096f93d40d3b8b2b1970f3724c692ae4805a

SHA256
ca75a899a8453eaec111a54389c404b063d308141c0460f30888c53c686fe888

SHA512
a66de369286eebb838f422fcb16c01e1d0fc14fb4f73a93b2d737efd0619e2d113d189c8953a33c77a084d5d5e47d121918f9e29fc2e96240bc212fefd5e98d0

Download Submit