b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exodus-12.20/Shaders/BasicVS_PBBNCTX.cso
Size

12KB
MD5

1106debb88f3e619533f3ddee3c02885
SHA1

f7fe97a42f560fc1c5e28d6dece0f586d5a531b4
SHA256

91935b49654fc122539eca1949aef723d0d8f205d131e994ddedccba96af4e12
SHA512

644f38df7bc59639b9cd56f3f15815c9fdb315c71fa6a7b4d44b9a1eb3127efa15d2865daec224ba0ca466d035c8e1e948b544fcd687138b797042f5514b94a9
SSDEEP

192:1RA3axRVvgbeK/p+CzzBnL2VnrYMMVRFSTFE/Mvm1GVIk1PbUCUMUuUD7NU3kUDf:1RA3axRVvgbF/p+CzzFLmn3HCt

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	AcroRd32.exe
1600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2776 wrote to memory of 1600	2776	rundll32.exe	33
PID 2776 wrote to memory of 1600	2776	rundll32.exe	33
PID 2776 wrote to memory of 1600	2776	rundll32.exe	33
PID 2776 wrote to memory of 1600	2776	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTX.cso
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTX.cso
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PBBNCTX.cso"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
02d2ec99a6afd3efcc87536cec5c540f

SHA1
d9db23963fd33b370e30242916097a0af60ca69b

SHA256
f9d40ad090bc8fb6d02eab2661408804bd798d9f3a2e07a126794cb5fe5c54a7

SHA512
b0fd19b7a5fde285225f533b7fa03816e523e770a13f4bc6f4cb0b78f621f21ebaed308b22cac4211b8cc886c15d5647fc982fb9f10eeb0a8fe9ade50e26b444

Download Submit