fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Langs/ru_RU/pcsx2_Iconized.mo
Size

40KB
MD5

9503827ef52f789b5070e37df99ad958
SHA1

9ddea0977e5ec7dd9241343de0b6127ea8890bd9
SHA256

7202230dd95c958b249d0ffdcde286d2374273943ca0bdc0039f7b0e1d59ab88
SHA512

0cd6915d5beb493b745743c67852c6b5d850ddced08f8f9c26e746e2e941c64aed2c68d24326ec98d32f874e3a66d911a6d575b3922129ee9e3739c73f9c9401
SSDEEP

768:PMZtLnpgSLTXQ9rK1QVdcxAzq299/oMtw0cUcDS43OTEqju7ejt5hFmjvO1:PM7Lndu+xAG23jw0cUcG4ewqju7CTmj4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2788	2376	cmd.exe	29
PID 2376 wrote to memory of 2788	2376	cmd.exe	29
PID 2376 wrote to memory of 2788	2376	cmd.exe	29
PID 2788 wrote to memory of 2604	2788	rundll32.exe	30
PID 2788 wrote to memory of 2604	2788	rundll32.exe	30
PID 2788 wrote to memory of 2604	2788	rundll32.exe	30
PID 2788 wrote to memory of 2604	2788	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\ru_RU\pcsx2_Iconized.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\ru_RU\pcsx2_Iconized.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\ru_RU\pcsx2_Iconized.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1a050ab8558cfa6d38ebc6b5439b3da5

SHA1
f1ba6d7d70dd35e5d7a14f5668b92239277e2348

SHA256
60da219c27b7a2454635649693956e8aa35bf98f9c8868d3fb90b1c4a344f90d

SHA512
e8ef39465d22024b319089e6063bc1c0d3bedcb0eb9dd6e2bedd9213f11008ef770caa844a34b2b2082c2e15e00efcd54da28367729deffc4972226b5234779a

Download Submit