8f99614f343acd683b2944ff325c471a8da9c2991528c5e24908bf955df4100e

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/04/2023, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gbapokemonemerald3`Apr | 14 | 01:17 | 2023.gba
Size

716KB
MD5

5cc49a4c9e9890087c9826ff2c39d7a1
SHA1

0a0712659bb4d4886ff9beea20db1b59a22f80e4
SHA256

638fd40dda2fc6d7aceaddca1a70f6a2daa31b2df89b3c8201361a742ab2bcdc
SHA512

135f4770f3be68a1dc4597055d79f0b4adb474b3ad110034691e9d628abd2fbd958c1a345fd60402d46605217d58bdbb46f55c9eacfec9f5113e267eb3b5efcd
SSDEEP

1536:U7DcOoI7QIrnPupoHWo/oySP77rRVlEB:UfvQ2konSD7dV4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.gba\ = "gba_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.gba	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\gba_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1908	AcroRd32.exe
1908	AcroRd32.exe
1908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1144	1216	cmd.exe	29
PID 1216 wrote to memory of 1144	1216	cmd.exe	29
PID 1216 wrote to memory of 1144	1216	cmd.exe	29
PID 1144 wrote to memory of 1908	1144	rundll32.exe	30
PID 1144 wrote to memory of 1908	1144	rundll32.exe	30
PID 1144 wrote to memory of 1908	1144	rundll32.exe	30
PID 1144 wrote to memory of 1908	1144	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\gbapokemonemerald3`Apr _ 14 _ 01_17 _ 2023.gba"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gbapokemonemerald3`Apr _ 14 _ 01_17 _ 2023.gba
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gbapokemonemerald3`Apr _ 14 _ 01_17 _ 2023.gba"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...