2446da4dc365a025131229437caef72cdf34203e40fc927119272c3f45362c43

Analysis

max time kernel
209s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2023, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup PES 6 The Den Patch 2023.exe
Size

3.8MB
MD5

f673cdf142031f8fe9e2291ee898ce02
SHA1

3992c8af2975f3af532728507ed927b1ae9687d8
SHA256

2446da4dc365a025131229437caef72cdf34203e40fc927119272c3f45362c43
SHA512

dc800667d771aeb1c6a7d5d3ed76d8d9481974eb5e0c61f2109994eeaf259dac53e86b2542d6fc979aa683362928ef1c7ac44e761144ae97abc70bc4d9e5efba
SSDEEP

49152:aBuZrEU4UIbCd6BGeJgRh1ULnXp3qqeTI8pbBCZcC0sT5zs:8kL4UIbC9eJK1GrqEZcnslzs

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3448	Setup PES 6 The Den Patch 2023.tmp

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\R:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\Y:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\Z:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\L:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\P:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\F:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\G:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\I:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\J:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\K:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\N:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\A:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\B:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\U:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\V:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\W:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\S:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\T:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\E:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\X:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\O:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\H:	Setup PES 6 The Den Patch 2023.tmp
File opened (read-only)	\??\M:	Setup PES 6 The Den Patch 2023.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3448	Setup PES 6 The Den Patch 2023.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3448	3980	Setup PES 6 The Den Patch 2023.exe	85
PID 3980 wrote to memory of 3448	3980	Setup PES 6 The Den Patch 2023.exe	85
PID 3980 wrote to memory of 3448	3980	Setup PES 6 The Den Patch 2023.exe	85

C:\Users\Admin\AppData\Local\Temp\Setup PES 6 The Den Patch 2023.exe
"C:\Users\Admin\AppData\Local\Temp\Setup PES 6 The Den Patch 2023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\is-AC8IA.tmp\Setup PES 6 The Den Patch 2023.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AC8IA.tmp\Setup PES 6 The Den Patch 2023.tmp" /SL5="$A0056,784896,0,C:\Users\Admin\AppData\Local\Temp\Setup PES 6 The Den Patch 2023.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AC8IA.tmp\Setup PES 6 The Den Patch 2023.tmp

Filesize
3.0MB

MD5
c13dffb59d22ba84f0e88dbec81de19b

SHA1
b27a2833b2f30801abbb523798700801dcda6de0

SHA256
bdb80d16856b573b2aa93d8c5fade6ec4711e3c7de8ee4db0dc507235f0393d9

SHA512
845d4dc8db71fb67360fc9bad5d07182aec451bc96472f19088b3a56a4770ff3c97ce6a73fe6608d5c68de3bef26d8c92c574a0a7dc2c34cc133446e96bc23ae

Download Submit
memory/3448-174-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-138-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3448-141-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-142-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3448-162-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-168-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-172-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-176-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-178-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3448-180-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/3980-140-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3980-133-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download