b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exodus-12.20/Shaders/BasicVS_PBBNCTT.cso
Size

11KB
MD5

16f0aae227b19534fe9a98f86b884732
SHA1

4b830345b2572696852f2d5c5f66cca86dc0217c
SHA256

5c3ade24814c02b8ac5a7657b7e3d400babb84c25c6769cbf3f4357371562326
SHA512

1dbe05eb1b19ab9d0a873e5e722ad584c4b07eb993bef98f03b198f09f31240e9baa15ae9ea9d07ab850fd5b6acf654d92b9cc164fff08d74485a7f2523eec65
SSDEEP

192:y2XRA3axRVvgbeK/p+CzzBnLkSnWYMMVRFSTB2SsLFssIrPkqP4ENE2hUOUEcE9V:JRA3axRVvgbF/p+CzzFLznJwl

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1464	2204	cmd.exe	32
PID 2204 wrote to memory of 1464	2204	cmd.exe	32
PID 2204 wrote to memory of 1464	2204	cmd.exe	32
PID 1464 wrote to memory of 2724	1464	rundll32.exe	33
PID 1464 wrote to memory of 2724	1464	rundll32.exe	33
PID 1464 wrote to memory of 2724	1464	rundll32.exe	33
PID 1464 wrote to memory of 2724	1464	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTT.cso
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTT.cso
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTT.cso"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b0bf8e69cb2e4caf4b3b94c31247401d

SHA1
3b2b2f2608df88a11fda28e0b5969793d195d022

SHA256
36d257c8399d7bee88a24f79d1d14f5fd5e6e5fe6c150e70d1aae724708ee383

SHA512
69a4fbadfea86e4803a30cb0bf8359cea915febb7c8b1cf544c200cf2917ee0dbe88642c9337c15d01452f2633ac1e208f4389a777c7fd4433049c772fd9b9bf

Download Submit