Overview
overview
3Static
static
3Avatar PSN...s.json
windows7-x64
3Avatar PSN...s.json
windows10-2004-x64
3Avatar PSN Tools.exe
windows7-x64
1Avatar PSN Tools.exe
windows10-2004-x64
1Avatar PSN Tools.exe
windows7-x64
3Avatar PSN Tools.exe
windows10-2004-x64
1Avatar PSN Tools.pdb
windows7-x64
3Avatar PSN Tools.pdb
windows10-2004-x64
3Avatar PSN...v.json
windows7-x64
3Avatar PSN...v.json
windows10-2004-x64
3Avatar PSN...g.json
windows7-x64
3Avatar PSN...g.json
windows10-2004-x64
3Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1ref/Avatar...ls.exe
windows7-x64
1ref/Avatar...ls.exe
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 23:41
Static task
static1
Behavioral task
behavioral1
Sample
Avatar PSN Tools.deps.json
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Avatar PSN Tools.deps.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Avatar PSN Tools.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Avatar PSN Tools.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Avatar PSN Tools.pdb
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Avatar PSN Tools.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Avatar PSN Tools.runtimeconfig.dev.json
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
Avatar PSN Tools.runtimeconfig.dev.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Avatar PSN Tools.runtimeconfig.json
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Avatar PSN Tools.runtimeconfig.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Newtonsoft.Json.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ref/Avatar PSN Tools.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
ref/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
General
-
Target
Avatar PSN Tools.deps.json
-
Size
1KB
-
MD5
724c823582aa13a9a0f460fb3a7fac16
-
SHA1
3250b0999df20bfe37ab6fd6624886d159fac332
-
SHA256
4d834981db02af8510e7ff500b28d843c4a24e8c8f2c0d789e8b6353aba21bbc
-
SHA512
4596d45b6ec8f13cb7b899d177cfb2e18859031b6d7b31217b05400da3aab25a26781a92d91e3b8680cc7abc247bcc45943f2972629357b3e1b9577974b76e95
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\json_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2720 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2720 AcroRd32.exe 2720 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2276 wrote to memory of 2904 2276 cmd.exe rundll32.exe PID 2276 wrote to memory of 2904 2276 cmd.exe rundll32.exe PID 2276 wrote to memory of 2904 2276 cmd.exe rundll32.exe PID 2904 wrote to memory of 2720 2904 rundll32.exe AcroRd32.exe PID 2904 wrote to memory of 2720 2904 rundll32.exe AcroRd32.exe PID 2904 wrote to memory of 2720 2904 rundll32.exe AcroRd32.exe PID 2904 wrote to memory of 2720 2904 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.deps.json"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.deps.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.deps.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58ac1730d432c8a63ce2743fc04dac271
SHA1cf475558fb416ac3dbe2811a09b7e02de3b0e3ec
SHA256255b6f4e1c0ac3d2d0e1a1139d6bae9d52483053164aa1394eacfb683f350b7a
SHA512a473cfc3f691241237beb31d1679107a1fd9ad081f80fd47d1d087ed878340efba9e93017dfd1977dd9038aac4a80abaa7532ec58075869db41f495f1474e63f