Overview
overview
5Static
static
5beab83ee3c...83.exe
windows7-x64
4beab83ee3c...83.exe
windows10-2004-x64
4$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$_1_/Panor...th.exe
windows7-x64
1$_1_/Panor...th.exe
windows10-2004-x64
3Order_de.html
windows7-x64
3Order_de.html
windows10-2004-x64
3Order_en.html
windows7-x64
3Order_en.html
windows10-2004-x64
3Order_fr.html
windows7-x64
3Order_fr.html
windows10-2004-x64
3PanoramaSt...ch.pdf
windows7-x64
3PanoramaSt...ch.pdf
windows10-2004-x64
3PanoramaSt...al.pdf
windows7-x64
3PanoramaSt...al.pdf
windows10-2004-x64
3PanoramaSt...ro.exe
windows7-x64
3PanoramaSt...ro.exe
windows10-2004-x64
1PanoramaSt...on.pdf
windows7-x64
3PanoramaSt...on.pdf
windows10-2004-x64
3PanoramaSt...on.pdf
windows7-x64
3PanoramaSt...on.pdf
windows10-2004-x64
3PanoramaSt...wer.js
windows7-x64
3PanoramaSt...wer.js
windows10-2004-x64
3Qt5CoreR.dll
windows7-x64
1Qt5CoreR.dll
windows10-2004-x64
1Qt5GuiR.dll
windows7-x64
1Qt5GuiR.dll
windows10-2004-x64
1Analysis
-
max time kernel
96s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 08:43
Behavioral task
behavioral1
Sample
beab83ee3c6aa1b1a6355f237914423494be0b8ae8374fb88f464cc4df105b83.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
beab83ee3c6aa1b1a6355f237914423494be0b8ae8374fb88f464cc4df105b83.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$_1_/PanoramaStudio4Pro.lrplugin/win/appPath.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$_1_/PanoramaStudio4Pro.lrplugin/win/appPath.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Order_de.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Order_de.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Order_en.html
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Order_en.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Order_fr.html
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
Order_fr.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
PanoramaStudio Handbuch.pdf
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
PanoramaStudio Handbuch.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
PanoramaStudio Manual.pdf
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
PanoramaStudio Manual.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
PanoramaStudio4Pro.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
PanoramaStudio4Pro.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
PanoramaStudioViewer/Documentation.pdf
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
PanoramaStudioViewer/Documentation.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
PanoramaStudioViewer/Dokumentation.pdf
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
PanoramaStudioViewer/Dokumentation.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
PanoramaStudioViewer/panoStudioViewer.js
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
PanoramaStudioViewer/panoStudioViewer.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Qt5CoreR.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
Qt5CoreR.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Qt5GuiR.dll
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
Qt5GuiR.dll
Resource
win10v2004-20241007-en
General
-
Target
PanoramaStudio Handbuch.pdf
-
Size
5.5MB
-
MD5
39519d1d79e31521079077b47290c6e7
-
SHA1
1f37f8ce26ee6f95e277a3276ede47c0647efe1f
-
SHA256
35f0ea44afb514c4865f2b3824f0e04702e94eac37da8c99b344abee21df79fe
-
SHA512
0155b61fa31448291aef9f432bc4db3b221a3872340508464fb3c8f38cb621301d8980c3055f40b6bf6a5c414e10504eb470beb4ead3abe547d1ced50e91a701
-
SSDEEP
98304:jMQR94PP0dfQvbO568LPdbR1JdZuytj/xXHIJU3OVhbG:oq9msdYA68z7P+qZIyf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2568 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2568 AcroRd32.exe 2568 AcroRd32.exe 2568 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PanoramaStudio Handbuch.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a1ad5200a0b593776a649439b2d2a8fa
SHA14b476a66e699d565afdd343c789c6f2b74c0f35b
SHA256dc8e79da1054199ad0975a87bb6ffb39ba2b75815c44fbb4a6055a55d7ecb0fa
SHA51258c37d59b5c1c9e3aad8538c54e2ed06e177b72d9a76070f12b89add254db216f9f4de40b1307b06108deb79f4b38c3bd969ec96b9249ea6f9295bfe56a2b811