Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 10:29

General

  • Target

    M Centers.pdb

  • Size

    215KB

  • MD5

    d59b84fbc652bedb776bc68dbea23da0

  • SHA1

    9049dbe38dab0a65bec6b5fd3ab33a0e47101d8f

  • SHA256

    721c6742e07afc23f970993857dd2b33a9f84f4b1e45d0efd3cfeb4dad8c43ba

  • SHA512

    cd9b8cf30578c3431a47b2046cb05fc12eff8f6899c2e72b3b3e97d16f17acbb15d463fff3b07e7e54d3c210164ccb9630173a82caffb45f864985a77778c3d8

  • SSDEEP

    1536:LfDF3NiV/g6C+cp1vxrE3xbEPJuScJCGOiVyyDFUrE3xZJCGOiVyh:Lritg6bcp1vRUwPHTGly5UmGlyh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\M Centers.pdb"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\M Centers.pdb
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\M Centers.pdb"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b84bd8b549ac8e1c3818f2a7f095b865

    SHA1

    3f53fee98ce3829f114022391293860e3a1c37ca

    SHA256

    a61ab223919c32449688bb16eab2348a9d2bfce1a27b4cd954e0b3336bb5b5f7

    SHA512

    7bd0f0d986fca797288d30eb9dc4635def2b5d948a42801c6d04f0218a289fac73cfd48855fabd5386d96a195558bf272c59c4e087a2d632b4b3f328558d5adc