Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2024, 22:46 UTC

General

  • Target

    $TEMP/PCSX2 1.6.0/Langs/pl_PL/pcsx2_Iconized.mo

  • Size

    31KB

  • MD5

    dbb32767f9c24e5aacf85977d40834ee

  • SHA1

    d1a54669cfb65735e3b76c521387175aca68cc05

  • SHA256

    7d5057132c0868cc5e3384c03957fdad6b93e967b26244b39288467d850c9574

  • SHA512

    772b8f8176597a081c0720a783ae18b29becfa6b9e677cfd897572d97a7540b5365990e5fabf4c35117638119adc2df2e6a1a9b9b09d26d668f7bd639a1ad458

  • SSDEEP

    768:JcrtLnpgStTXQ9rK1QVdMfLGYxLx5M9bpQVIcnD:JiLn3uZ4fkpQ1D

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Iconized.mo"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Iconized.mo
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Iconized.mo"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9342f8fd9281fb31304f1f33d2529ec5

    SHA1

    14c8c01c79434219b1648e410a790a8f643c7c94

    SHA256

    053f5e2fe0a19b9236d9137d0a8ccce68acb0cdd79b73e92d595cfbaea45fbbb

    SHA512

    d8bff262c692d7e7d6946ea16858b2d556e81ed5190582b669ece0293ec2972e99330f9d271ad4e360806c3c0b4b3d303d82c71fb3a138f9957cd4112490a570

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.