b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exodus-12.20/Shaders/BasicVS_PBBNCTTT.cso
Size

11KB
MD5

57078a396efcc39724e3f3b4dab216f3
SHA1

afcf336d273745ec629ef901091f28d85e2a6f51
SHA256

cfc052998b773bd386d70b23effa94f4ffdabb65fcd75b805ed5c28628b650af
SHA512

d3704bd19c77c14121e3afa12bb669927f2a9f5c6f027406696a5eead0313d0138d342800eb5d46ae62190d1b908acdbeddf5b66686a81d2e9f4fd3862b2ffb1
SSDEEP

192:YRA3axRVvgbeK/p+CzzBnLay+nWYMMVRFSTB2SsLFssdPkqP4ENE2hUOUEcE97ZW:YRA3axRVvgbF/p+CzzFLadnFwh

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2532	1760	cmd.exe	32
PID 1760 wrote to memory of 2532	1760	cmd.exe	32
PID 1760 wrote to memory of 2532	1760	cmd.exe	32
PID 2532 wrote to memory of 2876	2532	rundll32.exe	33
PID 2532 wrote to memory of 2876	2532	rundll32.exe	33
PID 2532 wrote to memory of 2876	2532	rundll32.exe	33
PID 2532 wrote to memory of 2876	2532	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTTT.cso
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTTT.cso
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTTT.cso"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f7c57c0517f3a99143a12ac138b62f12

SHA1
08d8f0bac1914ebe941ddc51c146e841ae370bd0

SHA256
92d576d8c8d77a2ab3a6a7ec212970026e8aef14bacc38bc68a58604b1fdbaae

SHA512
b869810d456fd3abbac0d743c73d3746d5f713b325d4b08d3ce635fcda592550d60917649ed3ae272f2c5eb11bc51c4e74733811d339c29cf10784fe337aa78d

Download Submit