094f1679afec5ba28beb2ff79e210f62a9b6583a3a443e040edff0cd02583487

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2023 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geometry Dash 2.113 Original By TeamHax.rar
Size

227.7MB
MD5

517cc041b03494f5f0dd1a234e39881c
SHA1

535b3c305493b4adf1fb168b4a6164614e28a0e2
SHA256

094f1679afec5ba28beb2ff79e210f62a9b6583a3a443e040edff0cd02583487
SHA512

a760c45d108b14ba7eac1bac342e847814541c465478c3bd967755dea569fb535d54e7f201896445ff6c8644190d6d6d5e29dc199421fcc9df404e4fd5b9ea6a
SSDEEP

6291456:tDUiivR4w60ZbVq2wzDvV4XdqvnkWc+UBrNs:pKR4w60ZBn0DvVGdqvn6nBxs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

1768 OpenWith.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

OpenWith.exe

pid	process
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe
1768	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113 Original By TeamHax.rar"
1⤵
- Modifies registry class
PID:2356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads