Overview
overview
7Static
static
368d3c5169e...10.exe
windows7-x64
768d3c5169e...10.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3PDF Conver...te.exe
windows7-x64
3PDF Conver...te.exe
windows10-2004-x64
3PDF Conver...er.exe
windows7-x64
3PDF Conver...er.exe
windows10-2004-x64
3PDF Conver...er.dll
windows7-x64
3PDF Conver...er.dll
windows10-2004-x64
3PDF Conver...er.exe
windows7-x64
3PDF Conver...er.exe
windows10-2004-x64
3PDF Conver...al.chm
windows7-x64
1PDF Conver...al.chm
windows10-2004-x64
1PDF Conver...us.lnk
windows7-x64
3PDF Conver...us.lnk
windows10-2004-x64
6PDF Conver...lp.chm
windows7-x64
1PDF Conver...lp.chm
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 04:53
Static task
static1
Behavioral task
behavioral1
Sample
68d3c5169e6a8fe944f001cf364448adf5f2465ba9751faa55214ba5c9f2de10.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
68d3c5169e6a8fe944f001cf364448adf5f2465ba9751faa55214ba5c9f2de10.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PDF Converter Register/Auto_Update.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
PDF Converter Register/Auto_Update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PDF Converter Register/CrashReporter.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
PDF Converter Register/CrashReporter.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PDF Converter Register/FPPDFConverter.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
PDF Converter Register/FPPDFConverter.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PDF Converter Register/PDFConverterRegister.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
PDF Converter Register/PDFConverterRegister.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PDF Converter Register/Resources.bundle/Images/Operation manual/Manual.chm
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
PDF Converter Register/Resources.bundle/Images/Operation manual/Manual.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PDF Converter Register/Resources.bundle/Images/Status.lnk
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
PDF Converter Register/Resources.bundle/Images/Status.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PDF Converter Register/help.chm
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
PDF Converter Register/help.chm
Resource
win10v2004-20240802-en
General
-
Target
PDF Converter Register/Resources.bundle/Images/Status.lnk
-
Size
1KB
-
MD5
9a6d9f90e71b5b6a5d472983fa97e9f8
-
SHA1
295b443b1c849c50dae9bcfd5b0a5afcce1f35d6
-
SHA256
02edb9e24d818209a86fe5245d41fc3fc7d164c381c0486565bd47144b83ca67
-
SHA512
3dc167aa13b15eae2e4dbb3cb73cabefe1f3c260a353ac25bfb6208fc4f597276bec99d7375bed465a12ff7aee641755a2658d24b20d004e51779c6060792fa2
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell cmd.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff cmd.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\PDF Converter Register\Resources.bundle\Images\Status.lnk"1⤵
- Enumerates connected drives
- Modifies registry class
PID:5060
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:936