Analysis

  • max time kernel
    36s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2023, 19:56

General

  • Target

    BetterVjoy/BetterJoyForCemu.exe

  • Size

    504KB

  • MD5

    9c50e62c7c5b2c744c0e0e262559587d

  • SHA1

    cd1c8a831089773bdda662cba9906980a60f41c3

  • SHA256

    485750446b8631254c58f1beb4cdc260661da8dcd6797e053b06100cec4ca9f0

  • SHA512

    08c1c09cf489dc96c783a3f9def95fa224d0bab20f29a5e753da515b4503912fa7564d2cbc40538ea947eadff28ebde39dcd79bc9c57138d4cf27fc38bc921ab

  • SSDEEP

    6144:r2mMDxGySN8HTOmTXA6smTXA6umTXA6vmTXA684EYGtESbr88HTY6n8ZP67ymjX1:RQnXHhXHbXHKXH8xjLrRLn8Zi73XHV

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BetterVjoy\BetterJoyForCemu.exe
    "C:\Users\Admin\AppData\Local\Temp\BetterVjoy\BetterJoyForCemu.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Costura\BF6B5258CCAC3F91DFE41DB194CBF92A\64\vigemclient.dll

    Filesize

    23KB

    MD5

    ba4b7b4328a391bb09503f254a63b464

    SHA1

    9dc1161cfe484031a606a6ea350b2304ae145d1f

    SHA256

    5e0ede288c2e9e753386f09400c592aa872bfdb7680faef6f780e9b1720ace7c

    SHA512

    a2c05ff8378a9212f5b79c15dbde8f0f43a429efb1e802a33da7cea6be74b18fec6982d9372e3cbaf8b9e74dfbb0c1e2cfe8f6e636b72de1b66a5609d9a704e4

  • memory/1168-54-0x0000000001390000-0x0000000001412000-memory.dmp

    Filesize

    520KB

  • memory/1168-55-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1168-56-0x000000001ABD0000-0x000000001ABE8000-memory.dmp

    Filesize

    96KB

  • memory/1168-62-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1168-63-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1168-64-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB