fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Langs/sv_SE/pcsx2_Iconized.mo
Size

27KB
MD5

185100f5f1d963ae9d069143c91bf028
SHA1

4dfea2b71797958a5e737b56d45ba4ba37dc7092
SHA256

d02dbd62fe81ad680c82d3daaf2c6fad27a601e20f2c4a6d3c82bad512324208
SHA512

255c373dcf7ea0450266745df31ff0278f1c058fa7925cd88000f889f60e2c6d0796e25df0ad70f3771102708906b73fa7afc11dd7c1734efcc421465f16da5f
SSDEEP

768:1+tLnpgStTA9rK1QVdM4xJhK5gg2bofeTN/ken:uLne5xJhWggQofw/kM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2740	2668	cmd.exe	29
PID 2668 wrote to memory of 2740	2668	cmd.exe	29
PID 2668 wrote to memory of 2740	2668	cmd.exe	29
PID 2740 wrote to memory of 2616	2740	rundll32.exe	30
PID 2740 wrote to memory of 2616	2740	rundll32.exe	30
PID 2740 wrote to memory of 2616	2740	rundll32.exe	30
PID 2740 wrote to memory of 2616	2740	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Iconized.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Iconized.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Iconized.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d2ff74aa4023be44f1518af334289e1f

SHA1
d830eddab9914657638d94d1b1ab014c0f538564

SHA256
8d531627e99e219c5193096b1175401d1495dc365c95ec8634e1ad3cd7769027

SHA512
ad268fee48c1a8d20d1ae4aed0c5a9b6f5e15f0b439af055113f092f1358253462f3e0197fe8d41f214ef9d230e2ebb616871a7b000daecfd18405936c834329

Download Submit