bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
156s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/aa/Itch/StandaloneWindows/0e13d00.bundle
Size

19KB
MD5

20e71c4eaea6ec8aedefa3a777605c76
SHA1

3fbff38d15a636f8dcea3cb5dc9339c2d542cf5a
SHA256

df1d929b89942707c0621bfff65b6259cb3cb83d970c18c5ce4c82c0f972dd0f
SHA512

714e35b20bdf22e322712a6a99cdfc5f82d4a5944f3fcc36df28eb93dbfce2d9ae52ab907d9ea53f7ae1b87d37b5e3899f3f1e29fb3be04a1d14eac0f44cee92
SSDEEP

384:9NqMmL5kcnK1EKOuvICjgQZvZ1cA8BvI12bIGfYYEKzeQq5yUZ4FyeANH:9NlyZKOKPvj3l8I12cGfYrKMg9A5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.bundle	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\.bundle\ = "bundle_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\bundle_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	AcroRd32.exe
1672	AcroRd32.exe
1672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2864	2580	cmd.exe	31
PID 2580 wrote to memory of 2864	2580	cmd.exe	31
PID 2580 wrote to memory of 2864	2580	cmd.exe	31
PID 2864 wrote to memory of 1672	2864	rundll32.exe	32
PID 2864 wrote to memory of 1672	2864	rundll32.exe	32
PID 2864 wrote to memory of 1672	2864	rundll32.exe	32
PID 2864 wrote to memory of 1672	2864	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\0e13d00.bundle"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\0e13d00.bundle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\0e13d00.bundle"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c22adffba00a288d1d59176d75f76f59

SHA1
e1956501824f21b32d76f1362640f75976f5d2c4

SHA256
5035a32012369a65a827586b5d352a1baf7151ba9698b0f05d2f81655f24c50f

SHA512
97587aed03f7235ff949aa127589e23180ecd8dd4da0582bcfcf94444798fef8c3cb4e0fc31c53292dacdaa6a375b877fdac9fa17b10aca29f36ac68257d5f58

Download Submit