3987e77c1ccbb132c0c6f7cdd10c808d400366c5ad7ec7b2c553c0c5afc331c4

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Super Mario Bros Star Scramble.exe
Size

17.2MB
MD5

8d41889f7a4554523f0664d9407bb224
SHA1

b1697566e6db7149a5e3db4cae71a215c39fa9d2
SHA256

3987e77c1ccbb132c0c6f7cdd10c808d400366c5ad7ec7b2c553c0c5afc331c4
SHA512

f99730b4855d9d88a4a7639cc2606d082338f371f186094d5a56224e4a0351755790f5bb3f0e683ceefb81dc89adfed6d13c869b1c8d04d05edaf15eee32c74f
SSDEEP

393216:2kMdNR9O0tw5p6kDlG6Kk//9DFiLKZa7TCRe0IAEFteVHjxJHJhU:2xdv9Ozj6kDlf//+KZBwHAgeVHj3nU

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Super Mario Bros Star Scramble.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Super Mario Bros Star Scramble.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3236	Super Mario Bros Star Scramble.exe
3236	Super Mario Bros Star Scramble.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3744	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3744	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3236	Super Mario Bros Star Scramble.exe
3236	Super Mario Bros Star Scramble.exe

C:\Users\Admin\AppData\Local\Temp\Super Mario Bros Star Scramble.exe
"C:\Users\Admin\AppData\Local\Temp\Super Mario Bros Star Scramble.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
397B

MD5
18f13d5d50365841e15f38ff3b576470

SHA1
925af99273268c571faa7d8aec4ae16b3710fd28

SHA256
f5a513d977e777f36d61dbd5e2be3c737ade51f304a712f7955244264303adb4

SHA512
61f12376bcb1b41bd791f4b757a28241472e0857d6e25b2456d98b5d8511af1ee69a94a1d288799eb459aa6172ac63988af26694a1df4813e01b4ffa8ac1a326

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\openssl\cache\RevocationCacheFile.dat

Filesize
1024B

MD5
0f343b0931126a20f133d67c2b018a3b

SHA1
60cacbf3d72e1e7834203da608037b1bf83b40e8

SHA256
5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

SHA512
8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461

Download Submit