459c01ea8ce582cc0e35acad986e0c9f56331fe24e20c59852b6b63a47b68a87

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01-08-2023 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shotgun.King.The.Final.Checkmate.v1.37/Shotgun.King.The.Final.Checkmate.v1.37/data.sgr
Size

58.1MB
MD5

b2de32ac8e238cd01a7eebbd75874822
SHA1

33adf33b6bad9e0fd4604b9466ab01471ad3d94f
SHA256

cf554d88260294456878ae18be95ae55b01b03452709ca0c695098e09621f524
SHA512

1ab9980f14ca90a1fef83b090d46b4f6a0c596319dfb112412785ddc10a6446ad60605e28999a32492e380a5f514b27a4f21e468cb250a82ee67e62ac9686c12
SSDEEP

1572864:uqa22/GzJVKUTczxgTJlf+xyuXbnGCGvDaeP:AUVNTyOTGryjvDvP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.sgr	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.sgr\ = "sgr_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\sgr_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe
2816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2952	2592	cmd.exe	29
PID 2592 wrote to memory of 2952	2592	cmd.exe	29
PID 2592 wrote to memory of 2952	2592	cmd.exe	29
PID 2952 wrote to memory of 2816	2952	rundll32.exe	30
PID 2952 wrote to memory of 2816	2952	rundll32.exe	30
PID 2952 wrote to memory of 2816	2952	rundll32.exe	30
PID 2952 wrote to memory of 2816	2952	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Shotgun.King.The.Final.Checkmate.v1.37\Shotgun.King.The.Final.Checkmate.v1.37\data.sgr
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Shotgun.King.The.Final.Checkmate.v1.37\Shotgun.King.The.Final.Checkmate.v1.37\data.sgr
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Shotgun.King.The.Final.Checkmate.v1.37\Shotgun.King.The.Final.Checkmate.v1.37\data.sgr"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0f78cdb7e3fda59e031a4684722abb37

SHA1
358a01fbd53e15cbfdf071344589a1c92afa7ada

SHA256
9fe9f3016fcf90d24b330ee53bc8040d8f28c82b58053fc76138ca520971be75

SHA512
19c389ec51cbf31155d1f14f9a2f367a40fa4634a1d46689acd1d7fb8873081a60e893114ea918601a97a1f1ca1f68caf74f549073f5b5f5f931af715650a8b7

Download Submit