b5748bdb4ab2a7132b1bec0c0e421e18d71b8ecb73351c6ae1ce6239c9c55462

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exodus-12.20/Shaders/BasicVS_PNCCT.cso
Size

9KB
MD5

d5e5655ba6048f0042c97df9ee070f2c
SHA1

557cb72d0a08f662334096dc807708d6ab922ae2
SHA256

9886888bbc3d1b308a178f8de0bca3dfcebfe28aa94968e14455bbad6019f447
SHA512

98af7f23232a13e6794b0cbba27ead5fb61dd4373d5a294ab8411f15e154db28185713478f70c6e3f536ec675cc07a459ff1700eb147f1d168c2657c5e9cbbf8
SSDEEP

192:ppi7nLgialn9SsREDMdubu2plMh/OwCxkk/uBrAqgMbX60E7VTqgMbSpxx1G4:ppuLfynvID

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2724	2736	cmd.exe	29
PID 2736 wrote to memory of 2724	2736	cmd.exe	29
PID 2736 wrote to memory of 2724	2736	cmd.exe	29
PID 2724 wrote to memory of 2720	2724	rundll32.exe	30
PID 2724 wrote to memory of 2720	2724	rundll32.exe	30
PID 2724 wrote to memory of 2720	2724	rundll32.exe	30
PID 2724 wrote to memory of 2720	2724	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PNCCT.cso
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PNCCT.cso
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Exodus-12.20\Shaders\BasicVS_PNCCT.cso"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
763a73dcc8565e4610b7493457083dbf

SHA1
05d8cd03a7cc38441892a5257a3ed70087b5cc84

SHA256
b1ed47c346ed8adbfc71d60bb6faa141950acae5f8aed697a6023895752f4963

SHA512
f6d07d5043e72729e82d2e53369c6b55c97b8772b63e0a572d5418585ced076036a0567ef023f26542d58666ee7157e6ef75d21ee2b484321e15f3722a6274d5

Download Submit