cbf710b8e6b29f0904e289a9b9a895548a2d7c7af5a3145c8279b97a69a09276

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-04-2023 22:24

Target

desmume.ddb
Size

148KB
MD5

65b03450f3474ebf67e5f2c9ea9cbfe3
SHA1

18b671caba06e854031be7eb03a8480eda710a64
SHA256

1643d7b481c82b3073fd53a4e4451f0de3ac3a7ba63e97e602d5d4f8ae7f32df
SHA512

f4a5edb817600202db3c350e9a34e43ba91c92e63df8cf874594dc338b77dadc4e1411778b9dbe22e6deda8d6d2afede39074a08957564fb907c27221575aead
SSDEEP

3072:E+d4EI6CmDGlNT7mpVmHPf5jhIedW75W6D56Dx1:E+dO6CmKlNvmpVm35jSYWI6V69

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.ddb	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.ddb\ = "ddb_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\ddb_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1516	2004	cmd.exe	29
PID 2004 wrote to memory of 1516	2004	cmd.exe	29
PID 2004 wrote to memory of 1516	2004	cmd.exe	29
PID 1516 wrote to memory of 1892	1516	rundll32.exe	30
PID 1516 wrote to memory of 1892	1516	rundll32.exe	30
PID 1516 wrote to memory of 1892	1516	rundll32.exe	30
PID 1516 wrote to memory of 1892	1516	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\desmume.ddb
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\desmume.ddb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\desmume.ddb"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1892

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact