9c5f193fc0057d06c8be677ab806baaed3508d3e91f6dcce5bd297eaa704494f

Analysis

max time kernel
316s
max time network
317s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SceneryFN Launcher.pdb
Size

39KB
MD5

3f04a0c3b88cb4d5defbe6cd6d7d33ce
SHA1

32eff3fcac6d0cbe816a602389ae65c07a961256
SHA256

3cd4a05d07fd9454dc601695f86c9816b0b98db13acba38ede4b66f1c75cf6ad
SHA512

9f02b250baab54e8091da248f5e01b3950aa1617e8536515e0b93fba2557a16487f6f6fd9485065734e103003d728144f1110b1f72503df8bf30448a75bbaa5c
SSDEEP

768:JjpA4C+4NPuHn4dUllQ0I/ocu2t4dJEFMo:BHn4dUllQ02as4dJEFMo

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pdb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1960	AcroRd32.exe
1960	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2132	1760	cmd.exe	31
PID 1760 wrote to memory of 2132	1760	cmd.exe	31
PID 1760 wrote to memory of 2132	1760	cmd.exe	31
PID 2132 wrote to memory of 1960	2132	rundll32.exe	32
PID 2132 wrote to memory of 1960	2132	rundll32.exe	32
PID 2132 wrote to memory of 1960	2132	rundll32.exe	32
PID 2132 wrote to memory of 1960	2132	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SceneryFN Launcher.pdb"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SceneryFN Launcher.pdb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SceneryFN Launcher.pdb"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c000989ba747d5d66c0d2a55546d65e0

SHA1
4fdb4c06445493c0b0ac451bea2118200694c51a

SHA256
aef237df167d185189290179c3e49fcebd32b523db9db9c1d212769ee8bb748f

SHA512
e550c87184e8262333b3791d63bb233584d2303006a0c051fc4ff2dae1359a3d55f39a1e803aa07a07de28e14d12a693ab5fb1e812b0e2fcb6c787cf76867ae9

Download Submit