0fbec360d12da89a5ed772e4320f4ac64d01529def2be02a571bd139b3ebefca

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MemeSense/localizations/cs2-english.bin
Size

12KB
MD5

1e6fc289367fafd2de6e9cc40bd85493
SHA1

b84249dd8b578e34127906eff94769701f1d47f0
SHA256

dce5d104e945114f047a63c301f4bf9860a03b8b10ba3f4abbf63e598168ad62
SHA512

883c6900a17b96b8433d9f576d4e6a345f07c30b6e93a0ed35d4fdb4ccdb28af71dbb9ee8070c9c766f32508394c61c4a082b604ece877f12072fcee785cea34
SSDEEP

384:gnew1Xy9+tD421hyY2rEcCPQ0ztZrQYjcqLg:lx7EZ5tQn2g

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2548	2480	cmd.exe	28
PID 2480 wrote to memory of 2548	2480	cmd.exe	28
PID 2480 wrote to memory of 2548	2480	cmd.exe	28
PID 2548 wrote to memory of 2432	2548	rundll32.exe	29
PID 2548 wrote to memory of 2432	2548	rundll32.exe	29
PID 2548 wrote to memory of 2432	2548	rundll32.exe	29
PID 2548 wrote to memory of 2432	2548	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MemeSense\localizations\cs2-english.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MemeSense\localizations\cs2-english.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MemeSense\localizations\cs2-english.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
73b62b664a7b2e7d82d20d825d19b008

SHA1
a470ca242b3c825df0de8288c60eb7d26c01aadb

SHA256
3334dfccc4dca640cdb4ddceea415eb14abc2dd4aa3eafad480420abedf85204

SHA512
94eb917742c04f7b7c1dcfcc1c9c62bab16e2af8899c1e4d1f0ba72582f5f634b9a36b040f130978f3c2669134543b980548924644e183890dce23d3a63aaa14

Download Submit