Analysis
-
max time kernel
125s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-es -
resource tags
-
submitted
06-11-2023 12:36
General
-
Target
adventure Time/setup.exe
-
Size
621KB
-
MD5
1a7bb86336a129b039087cce0cfbbfef
-
SHA1
ceefd22ae179752abe0137870afb55ff481f27b0
-
SHA256
b8072d28e9f8892f7c9cb63f19cd1c3c741872542e0359920ae857ecbb3b8804
-
SHA512
f792b9f629f674036b3fae0c4c5d6eb2c41949a6ae48b81a733b6ecd87cdb42875547323e713b711a040dfafd27a2df96834be80aa2cd7ba419294ac66e28451
-
SSDEEP
12288:iSxG0h888888888888W88888888888wXpp2XgFEDm4RqOP/8O0ISBL/0ntZBIVlm:JxGnXpp4gQR1HA/0tMfm9aI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adventure Time\setup.exe"C:\Users\Admin\AppData\Local\Temp\adventure Time\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7CFDT.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7CFDT.tmp\setup.tmp" /SL5="$E0226,118784,0,C:\Users\Admin\AppData\Local\Temp\adventure Time\setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Adventure Time Explore the Dungeon Because I DON’T KNOW!\executable\AdventureTime.exe"C:\Program Files (x86)\Adventure Time Explore the Dungeon Because I DON’T KNOW!\executable\AdventureTime.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5f1d3ff8443297732862df21dc4e57262
SHA19069ca78e7450a285173431b3e52c5c25299e473
SHA256df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA512ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
-
Filesize
7.4MB
MD5f59b58795e81c0de149f3cbc6a52e682
SHA1fa716820e5200c7049857c1f556faba12eadab35
SHA256021c980e49169ef87ec90ed1f75a548344ab8baa15f528f8ae99419d2571b57f
SHA512a63b8198bc032d638683269dce1a71c4edbffc458beb63275a603b58f9150fb23c28b1216db41158dee5ad007abb279b0049a94ca966b1bc3bd0e7fbd3193d62
-
Filesize
7.4MB
MD5f59b58795e81c0de149f3cbc6a52e682
SHA1fa716820e5200c7049857c1f556faba12eadab35
SHA256021c980e49169ef87ec90ed1f75a548344ab8baa15f528f8ae99419d2571b57f
SHA512a63b8198bc032d638683269dce1a71c4edbffc458beb63275a603b58f9150fb23c28b1216db41158dee5ad007abb279b0049a94ca966b1bc3bd0e7fbd3193d62
-
Filesize
7.4MB
MD5f59b58795e81c0de149f3cbc6a52e682
SHA1fa716820e5200c7049857c1f556faba12eadab35
SHA256021c980e49169ef87ec90ed1f75a548344ab8baa15f528f8ae99419d2571b57f
SHA512a63b8198bc032d638683269dce1a71c4edbffc458beb63275a603b58f9150fb23c28b1216db41158dee5ad007abb279b0049a94ca966b1bc3bd0e7fbd3193d62
-
Filesize
407KB
MD509cc59bb3f17fe183ea551a2dfedaa1d
SHA19e1b0569a8adc020c23cc240eee30ea1205515bc
SHA256de4590b6d4d0480351b1b438fd71cfd73b746bc8dbf24876150290570b1c3d73
SHA5126d59ca04d9ca4993508fdeb7b11b2878f8f52d2a388e4e399910cb5d6907574d96ec235f85ea990bdfd7354a0d9175c882573c54c6c7a9213103f6b490fe468c
-
Filesize
407KB
MD509cc59bb3f17fe183ea551a2dfedaa1d
SHA19e1b0569a8adc020c23cc240eee30ea1205515bc
SHA256de4590b6d4d0480351b1b438fd71cfd73b746bc8dbf24876150290570b1c3d73
SHA5126d59ca04d9ca4993508fdeb7b11b2878f8f52d2a388e4e399910cb5d6907574d96ec235f85ea990bdfd7354a0d9175c882573c54c6c7a9213103f6b490fe468c
-
Filesize
1.2MB
MD50d128559e37f0dbf8eb8bfe12d34635e
SHA1e23342abf403129519d6f8b89cdc651cd2706ed7
SHA256c11a046af3252fa99106f7123280ad01983c5992fa6c1a521c76b1126d7eb81f
SHA512f74d1348438b319292312099762ec9d5f095c4b4f7f2a79cadd35ef9683be93ee8fb20f908beae615a1ea3371eae5d6c6cdf40c759520cd55460186a408a47e9
-
Filesize
1.2MB
MD50d128559e37f0dbf8eb8bfe12d34635e
SHA1e23342abf403129519d6f8b89cdc651cd2706ed7
SHA256c11a046af3252fa99106f7123280ad01983c5992fa6c1a521c76b1126d7eb81f
SHA512f74d1348438b319292312099762ec9d5f095c4b4f7f2a79cadd35ef9683be93ee8fb20f908beae615a1ea3371eae5d6c6cdf40c759520cd55460186a408a47e9
-
Filesize
103KB
MD5cf096fb00135f5350aa466b3ea3d3b9f
SHA1b54e2da07cfba56a1c0ecba06412e619a39e10d5
SHA25661846524e09e81eeed65629cf3d65668773c377efefb236088d366c9068aee63
SHA51242b49e6cdac134df8626689b5a593d44895d854d89eaee58fd3be2e09d4fc827996ac25d87c6b19afd7a633f78fdefaeaaeb236a4592f1c48f400b778a11da61
-
Filesize
103KB
MD5cf096fb00135f5350aa466b3ea3d3b9f
SHA1b54e2da07cfba56a1c0ecba06412e619a39e10d5
SHA25661846524e09e81eeed65629cf3d65668773c377efefb236088d366c9068aee63
SHA51242b49e6cdac134df8626689b5a593d44895d854d89eaee58fd3be2e09d4fc827996ac25d87c6b19afd7a633f78fdefaeaaeb236a4592f1c48f400b778a11da61
-
Filesize
1.1MB
MD563b15124be653dbe589c7981da9d397c
SHA1af8874bdf2ad726f5420e8132c10becc2bbcd93c
SHA25661674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
SHA512339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8
-
Filesize
1.1MB
MD563b15124be653dbe589c7981da9d397c
SHA1af8874bdf2ad726f5420e8132c10becc2bbcd93c
SHA25661674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
SHA512339b284b5dd7386dcfa86c8fdcf239a0e97cc168229ea9a66fc0c6b26771401fa7f27c2c6a435a836a43ea9c7e634a3e47ec77e0d27985794bbb4416dfc97ac8
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB