Overview
overview
3Static
static
3Tool.zip
windows7-x64
3Tool.zip
windows10-2004-x64
1Tool/Avata...s.json
windows7-x64
3Tool/Avata...s.json
windows10-2004-x64
3Tool/Avata...ls.exe
windows7-x64
1Tool/Avata...ls.exe
windows10-2004-x64
1Tool/Avata...ls.exe
windows7-x64
3Tool/Avata...ls.exe
windows10-2004-x64
1Tool/Avata...ls.pdb
windows7-x64
3Tool/Avata...ls.pdb
windows10-2004-x64
3Tool/Avata...v.json
windows7-x64
3Tool/Avata...v.json
windows10-2004-x64
3Tool/Avata...g.json
windows7-x64
3Tool/Avata...g.json
windows10-2004-x64
3Tool/Avata...on.dll
windows7-x64
1Tool/Avata...on.dll
windows10-2004-x64
1Tool/Avata...ls.exe
windows7-x64
1Tool/Avata...ls.exe
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
Tool.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Tool.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Tool/Avatar Tools/Avatar PSN Tools.deps.json
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Tool/Avatar Tools/Avatar PSN Tools.deps.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Tool/Avatar Tools/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Tool/Avatar Tools/Avatar PSN Tools.pdb
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Tool/Avatar Tools/Avatar PSN Tools.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.dev.json
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.dev.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.json
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Tool/Avatar Tools/Avatar PSN Tools.runtimeconfig.json
Resource
win10v2004-20240910-en
Behavioral task
behavioral15
Sample
Tool/Avatar Tools/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Tool/Avatar Tools/Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Tool/Avatar Tools/ref/Avatar PSN Tools.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Tool/Avatar Tools/ref/Avatar PSN Tools.exe
Resource
win10v2004-20240802-en
General
-
Target
Tool/Avatar Tools/Avatar PSN Tools.deps.json
-
Size
1KB
-
MD5
724c823582aa13a9a0f460fb3a7fac16
-
SHA1
3250b0999df20bfe37ab6fd6624886d159fac332
-
SHA256
4d834981db02af8510e7ff500b28d843c4a24e8c8f2c0d789e8b6353aba21bbc
-
SHA512
4596d45b6ec8f13cb7b899d177cfb2e18859031b6d7b31217b05400da3aab25a26781a92d91e3b8680cc7abc247bcc45943f2972629357b3e1b9577974b76e95
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2772 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2772 AcroRd32.exe 2772 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2104 wrote to memory of 2756 2104 cmd.exe rundll32.exe PID 2104 wrote to memory of 2756 2104 cmd.exe rundll32.exe PID 2104 wrote to memory of 2756 2104 cmd.exe rundll32.exe PID 2756 wrote to memory of 2772 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2772 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2772 2756 rundll32.exe AcroRd32.exe PID 2756 wrote to memory of 2772 2756 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.deps.json"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.deps.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.deps.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59c55c5f77d2c11f6aa65d2ab66c9186a
SHA1b61e26104b2bc1b18a5bde64d3bdacbfc3f662f1
SHA25669d8f7dcbb74af280ba632a77d8325f61d451521586bf6a7f149189e7a1b0a8d
SHA51263e9e303d340d9d3442f7d19f9ffa51e1ba3a0d6e5999c3523b64f9c311579c0bbf0aa220a671db140ca7b0a4a8485b41767ba9f2c8457d6e2a7bb29d60f497b