Overview
overview
7Static
static
7FunGame.apk
android-9-x86
1Android
windows7-x64
1Android
windows10-2004-x64
1Android.manifest
windows7-x64
3Android.manifest
windows10-2004-x64
3GameSkins.xml
windows7-x64
1GameSkins.xml
windows10-2004-x64
1LobbyData.xml
windows7-x64
1LobbyData.xml
windows10-2004-x64
1PokerNewFeatures.xml
windows7-x64
1PokerNewFeatures.xml
windows10-2004-x64
1RuntimeIni...s.json
windows7-x64
3RuntimeIni...s.json
windows10-2004-x64
3ScriptingA...s.json
windows7-x64
3ScriptingA...s.json
windows10-2004-x64
3Settings.xml
windows7-x64
1Settings.xml
windows10-2004-x64
1TeenPattiG...ns.xml
windows7-x64
1TeenPattiG...ns.xml
windows10-2004-x64
1TeenPattiN...es.xml
windows7-x64
1TeenPattiN...es.xml
windows10-2004-x64
1TeenPattiUserData.xml
windows7-x64
1TeenPattiUserData.xml
windows10-2004-x64
1UserData.xml
windows7-x64
1UserData.xml
windows10-2004-x64
1appbackgroundstheme2d
windows7-x64
1appbackgroundstheme2d
windows10-2004-x64
1appbackgro...nifest
windows7-x64
3appbackgro...nifest
windows10-2004-x64
3boot.config
windows7-x64
3boot.config
windows10-2004-x64
3data.unity3d
windows7-x64
3Analysis
-
max time kernel
155s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
FunGame.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
Android
Resource
win7-20231020-en
Behavioral task
behavioral3
Sample
Android
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
Android.manifest
Resource
win7-20231023-en
Behavioral task
behavioral5
Sample
Android.manifest
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
GameSkins.xml
Resource
win7-20231025-en
Behavioral task
behavioral7
Sample
GameSkins.xml
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
LobbyData.xml
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
LobbyData.xml
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
PokerNewFeatures.xml
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
PokerNewFeatures.xml
Resource
win10v2004-20231025-en
Behavioral task
behavioral12
Sample
RuntimeInitializeOnLoads.json
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
RuntimeInitializeOnLoads.json
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
ScriptingAssemblies.json
Resource
win7-20231023-en
Behavioral task
behavioral15
Sample
ScriptingAssemblies.json
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
Settings.xml
Resource
win7-20231023-en
Behavioral task
behavioral17
Sample
Settings.xml
Resource
win10v2004-20231020-en
Behavioral task
behavioral18
Sample
TeenPattiGameSkins.xml
Resource
win7-20231020-en
Behavioral task
behavioral19
Sample
TeenPattiGameSkins.xml
Resource
win10v2004-20231020-en
Behavioral task
behavioral20
Sample
TeenPattiNewFeatures.xml
Resource
win7-20231025-en
Behavioral task
behavioral21
Sample
TeenPattiNewFeatures.xml
Resource
win10v2004-20231023-en
Behavioral task
behavioral22
Sample
TeenPattiUserData.xml
Resource
win7-20231023-en
Behavioral task
behavioral23
Sample
TeenPattiUserData.xml
Resource
win10v2004-20231023-en
Behavioral task
behavioral24
Sample
UserData.xml
Resource
win7-20231023-en
Behavioral task
behavioral25
Sample
UserData.xml
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
appbackgroundstheme2d
Resource
win7-20231020-en
Behavioral task
behavioral27
Sample
appbackgroundstheme2d
Resource
win10v2004-20231020-en
Behavioral task
behavioral28
Sample
appbackgroundstheme2d.manifest
Resource
win7-20231025-en
Behavioral task
behavioral29
Sample
appbackgroundstheme2d.manifest
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
boot.config
Resource
win7-20231020-en
Behavioral task
behavioral31
Sample
boot.config
Resource
win10v2004-20231023-en
Behavioral task
behavioral32
Sample
data.unity3d
Resource
win7-20231020-en
General
-
Target
data.unity3d
-
Size
79.3MB
-
MD5
4b1a0297095b510598eee52a46aad239
-
SHA1
afc9b07a06f7ae61b03a0af9166055106644219e
-
SHA256
54bcfb17f1e1d1c57f00deda8a4a54b0ba9b461a939b35227cf8c97bd13f06d5
-
SHA512
a1088ba92b6986ba2612042e6cdeb689aa9c83bc92f120d1a90baa329283f75fb42e4db1b1f54e90bb2ae8fc25e85416126f54b921a3c54bea4fa350d75a0099
-
SSDEEP
1572864:ixkfst5mxqxiGEcP+M/EN3boVlQmwvdidKvOhmlktA40:ckfqgGEcP+Me3EVl8mKvemlkq40
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.unity3d rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.unity3d\ = "unity3d_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\unity3d_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2104 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2104 AcroRd32.exe 2104 AcroRd32.exe 2104 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2796 2120 cmd.exe 29 PID 2120 wrote to memory of 2796 2120 cmd.exe 29 PID 2120 wrote to memory of 2796 2120 cmd.exe 29 PID 2796 wrote to memory of 2104 2796 rundll32.exe 30 PID 2796 wrote to memory of 2104 2796 rundll32.exe 30 PID 2796 wrote to memory of 2104 2796 rundll32.exe 30 PID 2796 wrote to memory of 2104 2796 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data.unity3d1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data.unity3d2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data.unity3d"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54ab1f75c1f6d97d758a40396586663c0
SHA127d31afb7a907922cced57b5bc38eaf89d87ef46
SHA25603435bd898842dbe486c730ae4977c3fb02d60eea37996ab56b070348a6bacec
SHA51230c167f9fe185c483bdbd386075ec7d661d30e40576ff87c3efc654ce41dca337dcb1edb2535cb2d9c842a1c00ced6cd111fe597cfea3b18f85b14e10aeb75d1