dc287b1f38dfd32bdd479048022dba205674c378882867499ae216cbd251f6f5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/09/2023, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
Size

4.0MB
MD5

40e45a1b5d1493e4adbddc41248eeb0d
SHA1

9ca3c821a94bf934a7dfa62c101b673a014b1642
SHA256

dc287b1f38dfd32bdd479048022dba205674c378882867499ae216cbd251f6f5
SHA512

b9fa071713c40a3cec1c679ffba7ae3409cee46730ddb7240c11971cb5435782204bdc9b0c4eb4e2249f15130470368df043fd7a6e5d50d17abf87d386487759
SSDEEP

49152:FmfdOTMpa40Ab7JwSS9EFClzMucUJTYb6lHI5duHS3nZ561dFT/o0PmuYsdcg:qdwka4j0p9cei6sdES3XAdFGuYY1

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	RigidlApp.exe
File created	C:\Program Files\7-Zip\7-zip.dll	RigidlApp.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	RigidlApp.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	RigidlApp.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	RigidlApp.exe

Loads dropped DLL 7 IoCs

pid	Process
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
2432	RigidlApp.exe
2432	RigidlApp.exe
2432	RigidlApp.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RigidlApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	RigidlApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	RigidlApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	RigidlApp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
Token: SeDebugPrivilege	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1728	3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	28
PID 3044 wrote to memory of 1728	3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	28
PID 3044 wrote to memory of 1728	3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	28
PID 3044 wrote to memory of 1728	3044	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	28
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29
PID 1728 wrote to memory of 2432	1728	File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe	29

C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
"C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe
  "C:\Users\Admin\AppData\Local\Temp\File-BeamNG.drive-v0.23.5.2-Gnarly-Repacks_268171.exe" --pt
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe
    "C:\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\Program Files (x86)\RigidFEELINGisaApp\RigidlApp.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
76KB

MD5
1193cbe87e8c399b0d52c6789ad560ed

SHA1
39b0cfa96f37f943aa7c993d2199bb590efbc14b

SHA256
d7104b8ca24d8bd9bf42675418e7a807ffc738d25d20b613e25c274672b2d530

SHA512
989841e2265d676c17e8474b4aff65b37846030433243c6bceac957368e009a7538740535c78cb09b55dee65da6908ae245ce7cdb4386b0b1d8421609a6cef7f

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
76KB

MD5
1193cbe87e8c399b0d52c6789ad560ed

SHA1
39b0cfa96f37f943aa7c993d2199bb590efbc14b

SHA256
d7104b8ca24d8bd9bf42675418e7a807ffc738d25d20b613e25c274672b2d530

SHA512
989841e2265d676c17e8474b4aff65b37846030433243c6bceac957368e009a7538740535c78cb09b55dee65da6908ae245ce7cdb4386b0b1d8421609a6cef7f

Download Submit
\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
memory/1728-17-0x0000000000BF0000-0x000000000100E000-memory.dmp

Filesize
4.1MB

Download
memory/1728-2-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/3044-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x0000000000BF0000-0x000000000100E000-memory.dmp

Filesize
4.1MB

Download