fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Langs/th_TH/pcsx2_Iconized.mo
Size

29KB
MD5

4c66d238885331ffbf3fea07da4f7fbc
SHA1

76cacb64580d5d5d747196581ced0d2b8ab9299a
SHA256

edaa2a55817fad24a33ae2a06f35bf3897b1ca00f58280429591edad04b2d08a
SHA512

0a26b024c388f4d02aa624195a1b359e1e686fa18df11a20bed0e763712cbfcfc1e8463f507c7872f35e2a4ab0731eb3c5218d6069d588d2f3433bcc8e2d856e
SSDEEP

768:J/1HWTKlmTQVdMCejjck7SmMOUDkpKtNpG61OYw+kKkJHK58lFFgBCgXHpIbVee1:P9XdFBI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2936	2196	cmd.exe	29
PID 2196 wrote to memory of 2936	2196	cmd.exe	29
PID 2196 wrote to memory of 2936	2196	cmd.exe	29
PID 2936 wrote to memory of 2120	2936	rundll32.exe	30
PID 2936 wrote to memory of 2120	2936	rundll32.exe	30
PID 2936 wrote to memory of 2120	2936	rundll32.exe	30
PID 2936 wrote to memory of 2120	2936	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\th_TH\pcsx2_Iconized.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\th_TH\pcsx2_Iconized.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\th_TH\pcsx2_Iconized.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0fc32bc9d9598e7f1561bb6dc9463cc

SHA1
f87a486e9315b3741073ef17a1961e2791337255

SHA256
b8c4aa537db9c6a52381bc9549f8e95e5a31121cb82aab23acfbc9d77f3f1174

SHA512
c89ab7c557337fa045c30bf9309b326fc31f8f2d4ea416f0c919bda28d0ecd3d4a208768b697d84ecff6acacf296455e6a100162636629fbb0db4cc6a79d3f68

Download Submit