bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
153s
max time network
40s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/aa/Itch/StandaloneWindows/referen.bundle
Size

1.6MB
MD5

46d4916391d33ecf432a00d1bef9e91f
SHA1

fd331bfbef5adc69ad0fc400ed6a19a8ed5be799
SHA256

d75fe44bbc05f0db67400fffda2914196b034c2a3172e9fa5af8bc26a5d4cec8
SHA512

ca5fc5c960e348c2f527fc4b106dbec3640776296e94410acab15ce30526f9773add6f00f485c66cdff358674b3d1d0080383cec2c04ec83ba70203285c135ac
SSDEEP

49152:zdQ0FX0Q/pf2Lpnb3of0jbxPsoRf/Cg7wllaSTMRS:bXHxUYMjbaoB/TMlMST0S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.bundle\ = "bundle_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.bundle	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\bundle_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2864	2460	cmd.exe	31
PID 2460 wrote to memory of 2864	2460	cmd.exe	31
PID 2460 wrote to memory of 2864	2460	cmd.exe	31
PID 2864 wrote to memory of 3020	2864	rundll32.exe	32
PID 2864 wrote to memory of 3020	2864	rundll32.exe	32
PID 2864 wrote to memory of 3020	2864	rundll32.exe	32
PID 2864 wrote to memory of 3020	2864	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\referen.bundle"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\referen.bundle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\referen.bundle"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d1aae54450926f4883300aac51a46b7

SHA1
1881c650094cca7e580292bc322f5f72674eb94d

SHA256
0e395d71dab5a4ffc9e8c688a1f4f37899193ce742d4bc0a1bb326528cd9e397

SHA512
f7dda8e223d649dde132e36171293c2885ed9fedd229c851c4841e6a07575fe3715276c32294c4f3835dc8d3ce581172520341982774605eecc957104f846c73

Download Submit