Analysis

  • max time kernel
    152s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2023, 22:22

General

  • Target

    Expensive-2.0/natives/OpenAL.dll.git

  • Size

    40B

  • MD5

    aab7d521c776b290c5eb725832d0c2b5

  • SHA1

    711ed36fce3edf284d01c0657f0cd56154cd1fb3

  • SHA256

    6369f0eb7ede17f649b06cf6b34bd8a1e5a44edb69e93c975aada2adc683a4dc

  • SHA512

    54b10d77df099c1a0e36e43a4bc87d6d206ea1bec345385d3d38b8cea8df9cb98a168bc95b1ca3fd03afd4584149858f3bc15e1337bdcdb4a6f0bfdbc5aedec7

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.git
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.git
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Expensive-2.0\natives\OpenAL.dll.git"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    50ec0aa772082b0bc502e4491dde0d99

    SHA1

    01e7a8156f763b571bc981e6cefb6a3044cdecb7

    SHA256

    a33f349baed3be9986a6cc34560c4114caed4c35c70096c6e176a5fb5dcaf54b

    SHA512

    8a7108f9a44505919b9e5c26d70f2899bd848d627ebda30af4a5f51108fb83dc9ff74ac33e359cb27931f727576cc8b10321c34443fd674e094014293aeefcf0