Overview
overview
8Static
static
3M Centers ...86.zip
windows7-x64
1M Centers ...86.zip
windows10-2004-x64
1FluentWPF.dll
windows7-x64
1FluentWPF.dll
windows10-2004-x64
1M Centers.exe
windows7-x64
6M Centers.exe
windows10-2004-x64
8M Centers.exe.config
windows7-x64
3M Centers.exe.config
windows10-2004-x64
3M Centers.pdb
windows7-x64
3M Centers.pdb
windows10-2004-x64
3MCentersLibrary.dll
windows7-x64
3MCentersLibrary.dll
windows10-2004-x64
3MCentersLibrary.pdb
windows7-x64
3MCentersLibrary.pdb
windows10-2004-x64
3MaterialDe...rs.dll
windows7-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...pf.dll
windows7-x64
1MaterialDe...pf.dll
windows10-2004-x64
1MaterialDe...pf.xml
windows7-x64
3MaterialDe...pf.xml
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
M Centers 8th Edition 8.0.1.3 x86.zip
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
M Centers 8th Edition 8.0.1.3 x86.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FluentWPF.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FluentWPF.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
M Centers.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
M Centers.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
M Centers.exe.config
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
M Centers.exe.config
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
M Centers.pdb
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
M Centers.pdb
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
MCentersLibrary.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
MCentersLibrary.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
MCentersLibrary.pdb
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
MCentersLibrary.pdb
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
MaterialDesignColors.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
MaterialDesignColors.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
MaterialDesignThemes.Wpf.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
MaterialDesignThemes.Wpf.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
MaterialDesignThemes.Wpf.xml
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
MaterialDesignThemes.Wpf.xml
Resource
win10v2004-20241007-en
General
-
Target
M Centers.pdb
-
Size
215KB
-
MD5
d59b84fbc652bedb776bc68dbea23da0
-
SHA1
9049dbe38dab0a65bec6b5fd3ab33a0e47101d8f
-
SHA256
721c6742e07afc23f970993857dd2b33a9f84f4b1e45d0efd3cfeb4dad8c43ba
-
SHA512
cd9b8cf30578c3431a47b2046cb05fc12eff8f6899c2e72b3b3e97d16f17acbb15d463fff3b07e7e54d3c210164ccb9630173a82caffb45f864985a77778c3d8
-
SSDEEP
1536:LfDF3NiV/g6C+cp1vxrE3xbEPJuScJCGOiVyyDFUrE3xZJCGOiVyh:Lritg6bcp1vRUwPHTGly5UmGlyh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2656 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 AcroRd32.exe 2656 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2888 wrote to memory of 3052 2888 cmd.exe 31 PID 2888 wrote to memory of 3052 2888 cmd.exe 31 PID 2888 wrote to memory of 3052 2888 cmd.exe 31 PID 3052 wrote to memory of 2656 3052 rundll32.exe 32 PID 3052 wrote to memory of 2656 3052 rundll32.exe 32 PID 3052 wrote to memory of 2656 3052 rundll32.exe 32 PID 3052 wrote to memory of 2656 3052 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\M Centers.pdb"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\M Centers.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\M Centers.pdb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b84bd8b549ac8e1c3818f2a7f095b865
SHA13f53fee98ce3829f114022391293860e3a1c37ca
SHA256a61ab223919c32449688bb16eab2348a9d2bfce1a27b4cd954e0b3336bb5b5f7
SHA5127bd0f0d986fca797288d30eb9dc4635def2b5d948a42801c6d04f0218a289fac73cfd48855fabd5386d96a195558bf272c59c4e087a2d632b4b3f328558d5adc