a3375d6f37d30f37ce07192cc83564c01c475abaa6acce9d2053f0c287bcb741

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gacha Neon PCversion/Gacha Neon PC.exe
Size

228KB
MD5

95a602e0af7b14cd35c23d9e8a3f2ded
SHA1

f85fc2a23a08be0dbd72baff417d9f5511b7f999
SHA256

9469e33bc94de73da8ff05788c3d8ed77f0f33e6ce2bb4d1aa0373ec1c49fc0d
SHA512

8a9b6fc1ce9124ad73c85b4c22e2f5339c9264a80e8ce3ab5c931075195384d5733eb810735b84364bfcc0a1d6bcfb9c15e3dc35e0b1311582fcf65bb8e9f00e
SSDEEP

3072:NcR7HVcrFONqdOvS3f7fS9h4JLI/ZGACh++OylrEbFe0UxeE6yhN1vs0ZslVnZLs:NcXumKtGOnOylrEbwp15slVnZLtvwJ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Gacha Neon PC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Gacha Neon PC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	628	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	628	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	Gacha Neon PC.exe

C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Gacha Neon PC.exe
"C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Gacha Neon PC.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...