7e83112aa106b22580bd34202564c60edbcef45b43e3325d86483b53f94fe37b

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-09-2022 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fivem-Spoofer-main/Spoofer.cpp
Size

11KB
MD5

19ea03bf7aa14db19f1da6edafb91b26
SHA1

b8c04a456a0b3800100973feead35f1718d0edb6
SHA256

9bf57213f60000664be0f8049487dd081f220d46fc849b721b0a601ac92982f1
SHA512

3cee0f12a4e6a68daab3a13fa9cb8e0af590aa058e76127ed5f37ec23de4f4fc236c416d215f71bd9e8674cb9f89efb45e415ecd93a8cf701c42e2356a77b167
SSDEEP

192:TU6Flhbn2gR9SaSHmFzUJmDAm1Jm1P1a2cm7DKGmFmTSvJj5W73/3Wlbj/VNwxqD:Tzz/JSHgUJuA4Jcac7DKGMQS15W73AVB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.cpp\ = "cpp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.cpp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\cpp_auto_file\shell\open\command	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 680	1464	cmd.exe	28
PID 1464 wrote to memory of 680	1464	cmd.exe	28
PID 1464 wrote to memory of 680	1464	cmd.exe	28
PID 680 wrote to memory of 2044	680	rundll32.exe	29
PID 680 wrote to memory of 2044	680	rundll32.exe	29
PID 680 wrote to memory of 2044	680	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fivem-Spoofer-main\Spoofer.cpp
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Fivem-Spoofer-main\Spoofer.cpp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Fivem-Spoofer-main\Spoofer.cpp
    3⤵
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download