bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 12:59

Target

Among Us v2022.12.14i-Pivigames.blog.rar
Size

244.1MB
MD5

d7951aa0674836da3859a056ff3d3b80
SHA1

d4f9d707654a24e4fe16677c6898054f990c1cae
SHA256

bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650
SHA512

cdb0b54f71b67ad0d4117215c7eb5ab26ea3d4b0a3a6314584f74af808c5180f6e776dd2db1dc4b730929cd9e5090ad0ce644e83ea5852136e5d26a4762f2580
SSDEEP

3145728:VutNH6ihsRWRi9S10xIO2H0VzM/6vk+NUdjqUMQiD+0oM7QDD4XglRdw8g5cEsO2:VutNH6s49FxDvVi8pN32mTQC4L9sO

Score

5^/10

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	mspaint.exe
392	mspaint.exe

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog.rar"
1⤵
- Modifies registry class
PID:4284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4128

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1252-133-0x0000021F8ABC0000-0x0000021F8ABD0000-memory.dmp

Filesize
64KB

Download
memory/1252-137-0x0000021F8B460000-0x0000021F8B470000-memory.dmp

Filesize
64KB

Download
memory/1252-144-0x0000021F93750000-0x0000021F93751000-memory.dmp

Filesize
4KB

Download
memory/1252-146-0x0000021F937D0000-0x0000021F937D1000-memory.dmp

Filesize
4KB

Download
memory/1252-148-0x0000021F937D0000-0x0000021F937D1000-memory.dmp

Filesize
4KB

Download
memory/1252-149-0x0000021F93860000-0x0000021F93861000-memory.dmp

Filesize
4KB

Download
memory/1252-150-0x0000021F93860000-0x0000021F93861000-memory.dmp

Filesize
4KB

Download
memory/1252-151-0x0000021F93860000-0x0000021F93861000-memory.dmp

Filesize
4KB

Download
memory/1252-152-0x0000021F93860000-0x0000021F93861000-memory.dmp

Filesize
4KB

Download