fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Langs/sv_SE/pcsx2_Main.mo
Size

57KB
MD5

68071ae3e83131665387682d21f72c32
SHA1

b402fee61e3a617d1d13b45fad0285712a08aa70
SHA256

bad98ae146b5981c7141ee76ce083318f963cc01bdfd663754acbdb2a89c912c
SHA512

4122c1e244ffb72c2e417cf9ee1f7efc2ba6ad5826dc4944a23e581b25de8b41b74b536c2664d1f04f00fc42088a7926ca200fbf1454150b1c07c253a3192690
SSDEEP

1536:Xd3dibMomHwzxKqfQXuRVc9RkplAVfm6Ni:XhdigUz9fYuRVc3kLAVfZNi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1604	AcroRd32.exe
1604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1948	2812	cmd.exe	30
PID 2812 wrote to memory of 1948	2812	cmd.exe	30
PID 2812 wrote to memory of 1948	2812	cmd.exe	30
PID 1948 wrote to memory of 1604	1948	rundll32.exe	31
PID 1948 wrote to memory of 1604	1948	rundll32.exe	31
PID 1948 wrote to memory of 1604	1948	rundll32.exe	31
PID 1948 wrote to memory of 1604	1948	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Main.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Main.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\sv_SE\pcsx2_Main.mo"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e7f2d7156cf95f23f2dd0d1313420f02

SHA1
1123994070fbec2d43fd9a387070c931d1a8129b

SHA256
c4e78f84963c40508f248dc56337fbd35579876690e969b21f1f059e354b9988

SHA512
7137977d59da2d95077f06312fe8cabe2a4cd0337f9a080864416097952c13cfc56b68e3de61d8c0cdff7ddcb17f65b7be684c872cf89634817e87b67d8ae6ac

Download Submit