fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
243s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Langs/pl_PL/pcsx2_Main.mo
Size

60KB
MD5

7f0bf137f7986c356c7c17ac050a463f
SHA1

375b8d313325b8efa39a5d638dfc3d3a9aee08a2
SHA256

ec0f73e541e41a738c70830e85252a7529d8537199d0228b89fef21de7c7246d
SHA512

979ad5a3fb98034792bb261c4be113c5fd5086e8c56b592252e2b68b051bd6c3bba35870a5ece523e44780cf462ce28e45b91bae49d0f43ec3d3e1d0808c4206
SSDEEP

768:6CEVldBUysl/vNC9sYp8wQQaTEV3lkRJgRs5m62WEzVc6J6RV0c8QQxAc+EcE:6CEVDBHCpwzuaf5LJ6R6VxL+EcE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
268	AcroRd32.exe
268	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2200	1864	cmd.exe	28
PID 1864 wrote to memory of 2200	1864	cmd.exe	28
PID 1864 wrote to memory of 2200	1864	cmd.exe	28
PID 2200 wrote to memory of 268	2200	rundll32.exe	29
PID 2200 wrote to memory of 268	2200	rundll32.exe	29
PID 2200 wrote to memory of 268	2200	rundll32.exe	29
PID 2200 wrote to memory of 268	2200	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Main.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Main.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Langs\pl_PL\pcsx2_Main.mo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
31f1b364e6097d0055451eb798672bfa

SHA1
2a79fa01903b17ee23b58195e8f0099a0ef0c8b9

SHA256
8b878287bae40db13b9854963f47b3273474707e2d58a8f563cfc78aa2be8040

SHA512
4ae303d190920620ce827fecd44482469deec15aa181ccf101369f17bed92033d2d95812e265c6fed059601e2195e5bd475cf23413906d56a00744be85a5649d

Download Submit