1e848b50a2c3344b77b89c3b4b33517a665b140495a18bdb8f34595652ee8b97

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Avatar PSN Tools.pdb
Size

13KB
MD5

9ed814e96b663efc3fbeb7107c43adfb
SHA1

c8c4e3470dd6cd964799c35e5417dff215ead52e
SHA256

bfc0efc839a22d921e3bfcfba4d50d98f205a87e866d011d3e184c17de7d8b14
SHA512

5e43de746950378b275caecaab322e720e86e78bf6e8de6d9a286d013bafa32253499dd528e437785a12c65001d1130f3bcaae8252ae1b9b9519b8d67a638dc6
SSDEEP

384:fuxxaRlQlhav4rZ0k/A8QZ1kbPW7nXZ5HLM/YcU6apH2fCcI+H3ht4oxWoIFF0H:fjV1kbgpVLcYchZ4SWM

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pdb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pdb\ = "pdb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pdb_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
2596 AcroRd32.exe

pid	process
2596	AcroRd32.exe

pid	process
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1544 wrote to memory of 2768	1544	cmd.exe	rundll32.exe
PID 1544 wrote to memory of 2768	1544	cmd.exe	rundll32.exe
PID 1544 wrote to memory of 2768	1544	cmd.exe	rundll32.exe
PID 2768 wrote to memory of 2596	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2596	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2596	2768	rundll32.exe	AcroRd32.exe
PID 2768 wrote to memory of 2596	2768	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.pdb"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.pdb
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Avatar PSN Tools.pdb"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cee7887000d91ffd5cbc27a23a7ab8df

SHA1
da7a5e376f7c721cebfdd1f3989cd239c232204d

SHA256
691fcf8f39d2ee4f6168d52883345bcf9c3cc4012bf63eefa3616fecf95337c3

SHA512
63985cb25d3d2aa657a1963f550ac9bbe36aa4480c0a6758aec54b83f394bbb398428655c3c1dbb9b80ffba1297e16e5f1686491799d8f94c1c78f13dde9ff8a

Download Submit