Overview
overview
3Static
static
3Tool.zip
windows7-x64
3Tool.zip
windows10-2004-x64
1Tool/Avata...s.json
windows7-x64
3Tool/Avata...s.json
windows10-2004-x64
3Tool/Avata...ls.exe
windows7-x64
1Tool/Avata...ls.exe
windows10-2004-x64
1Tool/Avata...ls.exe
windows7-x64
3Tool/Avata...ls.exe
windows10-2004-x64
1Tool/Avata...ls.pdb
windows7-x64
3Tool/Avata...ls.pdb
windows10-2004-x64
3Tool/Avata...v.json
windows7-x64
3Tool/Avata...v.json
windows10-2004-x64
3Tool/Avata...g.json
windows7-x64
3Tool/Avata...g.json
windows10-2004-x64
3Tool/Avata...on.dll
windows7-x64
1Tool/Avata...on.dll
windows10-2004-x64
1Tool/Avata...ls.exe
windows7-x64
1Tool/Avata...ls.exe
windows10-2004-x64
1Analysis
-
max time kernel
103s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
Tool.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Tool.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Tool/Avatar Tools/Avatar PSN Tools.deps.json
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Tool/Avatar Tools/Avatar PSN Tools.deps.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Tool/Avatar Tools/Avatar PSN Tools.pdb
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Tool/Avatar Tools/Avatar PSN Tools.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.dev.json
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.dev.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.json
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.json
Resource
win10v2004-20240910-en
Behavioral task
behavioral15
Sample
Tool/Avatar Tools/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Tool/Avatar Tools/Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Tool/Avatar Tools/ref/Avatar PSN Tools.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Tool/Avatar Tools/ref/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
General
-
Target
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.json
-
Size
154B
-
MD5
42cfea46ed97e8dbbd7bd335329ec2ac
-
SHA1
c4861e68c17b69f8beffb68d9198c5b49d15da9a
-
SHA256
3620d53dc87b4aa2cbd50b5ca80baa3e3a017d9d38cb72f690e44295afc33f77
-
SHA512
51d132a2ec34ba11b4a806870e7955b8bc5caea9e783a38918859cf8fa988552bd40fb6c71e21cacf8e7164d5ce12f2a5665f990f58ef99527bde8dffc1b5a2b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\json_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2820 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2820 AcroRd32.exe 2820 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1120 wrote to memory of 2756 1120 cmd.exe rundll32.exe PID 1120 wrote to memory of 2756 1120 cmd.exe rundll32.exe PID 1120 wrote to memory of 2756 1120 cmd.exe rundll32.exe PID 2756 wrote to memory of 2820 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2820 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2820 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2820 2756 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.runtimeconfig.json"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.runtimeconfig.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.runtimeconfig.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c2a126ae7622d33c1c1944af7e2fb9ac
SHA131a4c28dbbf36b69accdef2caa8d41c1eb121ed6
SHA256bb0fa7babd722d46edb5c092e126d8381441b443f2d9941027eedbd8f9c4c087
SHA512f297024cf0dd8e04f0153f0a4a3bdb4034ea3209b1cdbe82bc3b034889bc4747147925aaa83bd0762e6ec52d2e93208494146861a36e8ebfcaa45e9da0aae0ee