72b5e76a8256cf479be8ab736165302405cc399be066f8b9d7eb1ba52520e3c1

Resubmissions

03/02/2024, 06:55

240203-hp5czabeg7 7

03/02/2024, 06:52

03/02/2024, 06:46

03/02/2024, 06:41

03/02/2024, 06:38

03/02/2024, 05:47

03/02/2024, 05:22

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAM_Data/globalgamemanagers.assets.ress
Size

2.7MB
MD5

7423e95b309c209a70c3b8112f61d473
SHA1

8c8d65e4df4f89c0fa77b5ba6a8ec737113ef592
SHA256

39dd38fcd8dd95d41d6d55fe16a448d29fe2c31d9a162c825c24c6d99a893d7a
SHA512

617856a9aff5b357085a59ffc6bfd8a107a48ee22849ee190bdc1e81e1bdf9d9be9fb1fdaa5edd89b65ce1fc63a5525731f6526b14379b72c5396fd202d772aa
SSDEEP

1536:8nCugW37Qc/WRI5YYt3I/cTj3PzZxwWDPoAw5LoWi:4UW3stRLuxv3PQQQAJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.ress	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.ress\ = "ress_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\ress_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1376	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	AcroRd32.exe
1376	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2784	2508	cmd.exe	29
PID 2508 wrote to memory of 2784	2508	cmd.exe	29
PID 2508 wrote to memory of 2784	2508	cmd.exe	29
PID 2784 wrote to memory of 1376	2784	rundll32.exe	30
PID 2784 wrote to memory of 1376	2784	rundll32.exe	30
PID 2784 wrote to memory of 1376	2784	rundll32.exe	30
PID 2784 wrote to memory of 1376	2784	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
04a69df663848943f5defdafddcd2fed

SHA1
6a571c235cb3de89a5e48fa0c095882d05cef680

SHA256
645d6a7551fa0f4ec7c7f49d815e2565b73e9fb51a046ec6a8d54c74b413f9d4

SHA512
052d716a80b627eccc24e29f7961a5b15ee4b788ac93739b44ac6d6f9e09208f8f570debb1958529373a3464f9f6ce72f28db75d4279d4cd32596b46d0ee1cd4

Download Submit