86f4bff030f2f3dbdc6ec2eadc92392f706ca1988574fd91b4d66ba577277f2d

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PokemonQuetzalAlpha6v9.gba
Size

32.0MB
MD5

62e283d1d3c53a304b086e2ae8328f86
SHA1

6835442260fcb66c5892dba00530f80bdd08c86b
SHA256

86f4bff030f2f3dbdc6ec2eadc92392f706ca1988574fd91b4d66ba577277f2d
SHA512

e20fea2e3be0f0f41ec83e81736151b7908757ccd3ca89285a7542549a85485f7d58f9a78ff8955c70b932b1e02ff2c0431fd4eae7e6190dec715ef8bf92fb25
SSDEEP

196608:D3B7KGfGLjqfu2EUpgKRlIPYcsKqFkrIwIJ7:D3BQaulDAcsKqSjS7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\gba_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.gba	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.gba\ = "gba_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2768	1304	cmd.exe	29
PID 1304 wrote to memory of 2768	1304	cmd.exe	29
PID 1304 wrote to memory of 2768	1304	cmd.exe	29
PID 2768 wrote to memory of 2556	2768	rundll32.exe	30
PID 2768 wrote to memory of 2556	2768	rundll32.exe	30
PID 2768 wrote to memory of 2556	2768	rundll32.exe	30
PID 2768 wrote to memory of 2556	2768	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PokemonQuetzalAlpha6v9.gba
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PokemonQuetzalAlpha6v9.gba
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PokemonQuetzalAlpha6v9.gba"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d08692bb6f96c67420dc4e92d62ec36b

SHA1
5ab6b70aefc42f187b4f99cda67f9268d4e85989

SHA256
2135b74ca86a3e018f9d0ae5021410b19124bdfbc9d2fe5d6a46853214b2a5a5

SHA512
2811322f0ec3aa1ec89e49563d4842cb00b6b163102e15e3d97f7c8101cfef8287f44cd05a3a19e95cc6085842dfffcfff3d143c8f42b8ae113ec28965e02636

Download Submit