Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-12-2023 20:59
General
-
Target
ppsspp-1-16-6.exe
-
Size
21.0MB
-
MD5
d90c4d37778073c5940a994103d43f36
-
SHA1
cabba59cffe6e89b6cfcd042d22f3d83ff194be2
-
SHA256
10190dc080a18fc1c14806d4475dbf2f92432e925814561de506221af0312af7
-
SHA512
5c7932cc48a915e2d5af3a3a50fdae60c15729e8c20e87291a021448abc562b85fb0c9f8c91bc04d5b7e4acebcfad234e664cf35dec53296a6a9fb98f2355b09
-
SSDEEP
393216:QlpY3kCmGd5Q/BuiyAafNE+EibdpMabS/qpR6+Xtyt+BQ8HEGWrx44X5/R/1iH2e:Q/YUAviVANA6dp7FvPXtQ+qYELZPiWsD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 49 IoCs
-
Suspicious use of SendNotifyMessage 48 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ppsspp-1-16-6.exe"C:\Users\Admin\AppData\Local\Temp\ppsspp-1-16-6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I5SN9.tmp\ppsspp-1-16-6.tmp"C:\Users\Admin\AppData\Local\Temp\is-I5SN9.tmp\ppsspp-1-16-6.tmp" /SL5="$600EC,21547741,121344,C:\Users\Admin\AppData\Local\Temp\ppsspp-1-16-6.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\PPSSPP\PPSSPPWindows64.exe"C:\Program Files\PPSSPP\PPSSPPWindows64.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\PPSSPP\PPSSPPWindows64.exe"C:\Program Files\PPSSPP\PPSSPPWindows64.exe" --vulkan-available-check4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x510 0x4b81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.1MB
MD5b4ae50d1085227c1d59b51b329186870
SHA1e0fe633e9e1352a88ded77b4d43471897cc17c9e
SHA25647c235af2c9375b1695f6bf7e66d5679d1967c36f1e1059521fe1443eca79ccc
SHA5122503a296325660d4809e6cc5647e6a20b3cc1cca91e39a31c11b587c5c2c1cd6541c61e56ebc463ed46afd6461eac7563a88806b5fdeb5db5d4af9b81e9c3381
-
Filesize
13.7MB
MD522cf5acfb517497f97ba62664fd77fd3
SHA152f0d06c132ea8e96c00a776f99e15de269a729e
SHA256abec18ec921cf93264effbbd5261b675ddd9f453a71a877b0ee3f2953c52820f
SHA512c77228ec0f07ea843d58a53841f1adfae6e576a847cc356f1791512238ecbf6f34163f8da72c47900f6e6fb2429ea7a5cec680f46aeb6e37d1735ec2ab1591f2
-
Filesize
6KB
MD5a062688b08c70a42ff2a0acff6c46d93
SHA108325554623568bb9babadc10213bfc0b1151766
SHA25692ab3d61d17e6fa2111a80bd75d89cc241f2a85461d0f3e58198f84adcf35c9c
SHA512c23420967e83fbea19579d45b9840ecc4ab312442843cce6fc71c94774ee103bfc8bc332de62f738035c3b3cd4db666044eac059297bfb633db50f3ff766e49a
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
53KB
MD52339df8da60b69bafafdd472492c2f9e
SHA173ec4bd48427c0a70cc15dd7b3fdb105a31e47bd
SHA256a4e4ac5e1af82fe29a1e03022c2f04db303f7c065756feeef84bbd60bcbf10df
SHA5125498271c5dc06614854171165b2458f30eac1a7575c65262e75ad89cdc50633507fef9ef1657bbf70bc993257d79513467bd776e2621fc68788a0898be29fd3e
-
Filesize
79KB
MD5ffb05cbb000c2a3e6b2594e5d41b3b78
SHA1a66070651c75c377c043fa5d37590ee6004e30a4
SHA256c95f53b1279684c8db5f2b518a63675db3713b3c097c65fd2ff280baf29ffd34
SHA5125566e34f043db6a65de20edc8825fbe38d2a309e52d6a8fe1c0aadf4a2647c16655e2d5b150cd850508fead828f9e7bc93090f0a8930ced14fd0be666399d689
-
Filesize
31KB
MD5c873ac1ea00c42828e03d9898a3b41ef
SHA14fff7da19d8810d8fc8f97eb769bdfd15563658a
SHA2568e6550b975a34511788dbeaacae47c9be6c89c967052c12342c6cc32f5650e4c
SHA512c86c50b13cd2f5a961c3361f4b183930c62ee1e08ca00921c1aeebb306c69d2dd33a4952df3a8f46287869d55e387b42d2d3274d82d3e215ab06b3d3fb9d6258
-
Filesize
44KB
MD5c3bc568204bdecc72ef7120cc56d01b8
SHA156b05f7483e44889a1703fbb2d7318484e6d732f
SHA256c2fdb1d1e6e677883f13eb866a1d83b8f67cc94f00aec21163612f61afefb693
SHA512d3b323a3bf4ab325d230f07e54c84bf85f9739ba03310327ae3d8917034b7a356448d789d8f59200c2e1e7550cfdbe729220703a9f0bb9bdf4e702d8c9083c84
-
Filesize
92KB
MD538db23b9f4c7aba3bc831b42a90dac67
SHA10b436b5daa14683ee6c8942079b128e9549ded0a
SHA25661e780e220798f49d15e6d9eb85634a6e21f05765ed2a7aec682e196f4edda7d
SHA51261510809fa3acbab537080cd27d69c0f178f46df9d83751d1bf4338ff24e49697edd5123cb075d22762163281c63c2ffdfd4a2d4ba75d76147037e9e08042e96
-
Filesize
27KB
MD58f8a25fe78b52bd404c28dd06dc1aa23
SHA10bd3eabc432b6119507e4fc43354113b68bdbf66
SHA2566d108dcae03c5a4ea04136b972c7c202b8b5013f4771791f0cb7348db0051dc1
SHA51267dd6add09bd2febc19730f0b86128d6c2ea2b95b96dc18934844a0355cda4dbf5837e0a203b8775a25139bd19543445a824be5c10b8e42758d84e1efa7e380a
-
Filesize
33KB
MD591d7befe927f45c5aaa6df0b3b754a5c
SHA1d63735758f437788638edfc6cc2ce29afcf02cc5
SHA2565d3c60e5fd12658ffc562f14331b7d0c962b818bee4a38aa9c928d2f08fb4f6b
SHA5121c7b4fa8f48ce6230d3465736e94ab39409f20f2d35b04e7f8637e4fdafbd003e34d85a945c06fc976d1dc28a9778de3f89456f6274ded2fd9890de8a8a79591
-
Filesize
37KB
MD566b4e28e92ebc1b16305c1898caa69da
SHA17932cd34fce034aaae6867b41c84978d2d1504ab
SHA256f56b389dde4da2ad6f65f3ac136c3d9c1a681aa76c3ca531e984410b261b4810
SHA512d871a003564ed48189b7377debd3eec6aa2355d91af6d729c227fe9dac38baf8ca354fe4ef85f99283bc7b645bc7dcfb113f8fcca47ed96de1ab189231f296a3
-
Filesize
1KB
MD50ccba6a4a08d22e6496a90da91e9a402
SHA117b97d48013cfbda9fc86342e0b2f1cc56d13961
SHA256b341d69961db4cc9c93156ee1e14b03c09c9ffc1d57529b98ea82e908b6de4a9
SHA5122105c61b2f46a4dd475f2b32a299cac6093ba5f4e2a314275bbdd26cf6aab6559896ca7ba0f3786a3774b8a5c86729a734f201e2efca1c091bc77e31ce1f93d0
-
Filesize
1KB
MD552ed13a0d7e8e94a59a4ff7383de60cc
SHA187152dfd1fd2c1b30647f0ee6b16c754a420fd5f
SHA256f846a9f975fc996b120393ee3233b7292dd3298c62872baa7fc31101b528c8e7
SHA512bc058a949f9a67ea495830ff871488dae474227dc79077d360582b2472674ad3970e0b8d9c8b8b8c6568f9d869cb1bced5058f4fc54551583147dcedd860f0df
-
Filesize
70KB
MD5d984fb2e30f4db7b172b2598fd014109
SHA1900a8caf1a7a8773becb61068b155c95cbbcdd83
SHA256bb7df10b1e6caeb539d6c9507ef00d2d984c437a8a57c9be61073b6c9d6f7967
SHA512716f6caf824a89e742c17941c2680314ce28778ae1455adccbb70a567d01f3cb654e54408787f18b3f11ae6516195a0166513e3da0011c8745947a81659beec1
-
Filesize
1.6MB
MD54ef2e781c67b8de54fbddf2c3fe4bc04
SHA1a39acdd37172a5df4b1bc038d02a884c6bd0ce80
SHA2564bc1f49af06826941f3f6e735a3e80da3ea6f141c358ab504c1298bc0603b880
SHA512d37e4613b3cca1597db1d0687016cd36b43c9f6c71d8b07a47830d71431c8f629ae29116946d24fac9067b640d172f5391663dd79cfd886d7668fad60283a78d
-
Filesize
1.9MB
MD58913f22c729912406f3f54247969b4b4
SHA121aef3bfe3586e96dd54a3f09553985c93858260
SHA2562e0a644df12eff58087f47d751aaa184fb761763921c563ac4c3c9a92ee52235
SHA512174ad5c85a3631a381f972eb3bbafae38f8d417c65162f5750fce51a8c8ed145c44baea2a864f9ef4aa5327260a7c63d05479cda96ae74bd77ad9b2700049563
-
Filesize
149B
MD5db96d786bf4def028c7abdf5248b0845
SHA18e697e4c4cfd68323112904b0dab4bb85546e060
SHA2562a0937e6b494bfe812b3f49209dacfd83a3e38b39e561fd5a65706dd5a3bf4c4
SHA512a4ddc17b387c639d3d7e16ecb33a9d02616d4ed745ddfa2dc86bbc9831c9d36e8ce16ebf90d02f580db9df5fef09cc1cdabf25ae6403127c90fed1f84782e34a
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB