282b2bba57bb185fb81d4f401425efa9b6a6f99111640d99521b86b088f9aab9

Analysis

max time kernel
157s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DF CONNECTED v2.7.6c (Windows)/GameMaker Server+(Windows)1.lib
Size

176KB
MD5

af8e46fe2a1ac47af32fa8de12d93f05
SHA1

bd0ac7a308f6c21f18250557bb6147b114883da8
SHA256

29903db606cbec3db3712b71a6c46baeec579590bf57c9bd44c67bda60987524
SHA512

ce16b97a3eb0b6a6d96d63971f9f4a924e7d27d76ad31bc9cdddc963efc94c0b29d24952b23c28a52159550d23bc38369ab9a5153402be04c061af1b6ee33ac6
SSDEEP

768:UeyIcT9CJgmmqDerdQcDCQWcc6m1WWPlluw249XH9BCjFF:3ynTsammxPc6m1WWPlluww

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.lib	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\lib_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.lib\ = "lib_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2988	2588	cmd.exe	29
PID 2588 wrote to memory of 2988	2588	cmd.exe	29
PID 2588 wrote to memory of 2988	2588	cmd.exe	29
PID 2988 wrote to memory of 2664	2988	rundll32.exe	31
PID 2988 wrote to memory of 2664	2988	rundll32.exe	31
PID 2988 wrote to memory of 2664	2988	rundll32.exe	31
PID 2988 wrote to memory of 2664	2988	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DF CONNECTED v2.7.6c (Windows)\GameMaker Server+(Windows)1.lib"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DF CONNECTED v2.7.6c (Windows)\GameMaker Server+(Windows)1.lib
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DF CONNECTED v2.7.6c (Windows)\GameMaker Server+(Windows)1.lib"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f7de77e59db657f38c43e9ff138c3d55

SHA1
73829f495b8dd681a88bc8c81ee9dd4f6fac03ca

SHA256
64b022821f3bb860e8a8f6b6f21129005a4d99c975c3188495e05cfe320a1fb9

SHA512
934c5be1254f639a4b9cad1855ffdd46975109b78483fa5aae9311cdc3794b31da903dcb9d7d97ccc2e371f22a6368dc9b4b05d98b2dc264c07e25b4cfe9f58d

Download Submit