e7375848034d44f1f429fec5cdfa406b7e0424500eb5a76d7a7e5f593902f82b | Triage

Analysis

max time kernel
149s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:38

Sharing

Report Analysis Logs

General

Target

Fnf multi indev/FunkinMulti.exe
Size

15.4MB
MD5

2cf32f14cb000d1af1d0514450f3ff49
SHA1

adc575ed46e79dce4c6c47acd7e74d0d0548c2c0
SHA256

7bdc77e38f6b46af4b542fba305f96aa8024932eb4a0e5ab73a0a15d0af5b112
SHA512

5d12e2b8e0a464e3abe6a7af270b3cb676466dbd4990ae344a89fa408641dbc9ded364bea87692d0ba05856e39b2561b14f74f8116d065da6d06a8d516614524
SSDEEP

196608:0tjaaVveZ0plykebSrZeP8Lc2p0ufC1NZ9H:0tjaaVWZ0pUkebSleP8Lc2LCPZB

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

Processes:

FunkinMulti.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\shell\open\command	FunkinMulti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\ = "URL:Run game 825546135958585414 protocol"	FunkinMulti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\URL Protocol	FunkinMulti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fnf multi indev\\FunkinMulti.exe"	FunkinMulti.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\shell\open	FunkinMulti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fnf multi indev\\FunkinMulti.exe"	FunkinMulti.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414	FunkinMulti.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\DefaultIcon	FunkinMulti.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\discord-825546135958585414\shell	FunkinMulti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4000 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4000 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

FunkinMulti.exe

pid process

5004 FunkinMulti.exe

C:\Users\Admin\AppData\Local\Temp\Fnf multi indev\FunkinMulti.exe
"C:\Users\Admin\AppData\Local\Temp\Fnf multi indev\FunkinMulti.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x44c 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...