Overview
overview
4Static
static
1v1.3.2-202...01.zip
windows7-x64
1v1.3.2-202...01.zip
windows10-2004-x64
1v1.3.2/Gui..._2.txt
windows7-x64
1v1.3.2/Gui..._2.txt
windows10-2004-x64
1v1.3.2/Gui...de.txt
windows7-x64
1v1.3.2/Gui...de.txt
windows10-2004-x64
1v1.3.2/Gui..._2.png
windows7-x64
1v1.3.2/Gui..._2.png
windows10-2004-x64
1v1.3.2/Gui...e.docx
windows7-x64
4v1.3.2/Gui...e.docx
windows10-2004-x64
1v1.3.2/Gui..._2.txt
windows7-x64
1v1.3.2/Gui..._2.txt
windows10-2004-x64
1v1.3.2/Gui..._2.txt
windows7-x64
1v1.3.2/Gui..._2.txt
windows10-2004-x64
1v1.3.2/Gui...2.xlsx
windows7-x64
1v1.3.2/Gui...2.xlsx
windows10-2004-x64
1v1.3.2/Mod..._2.ips
windows7-x64
1v1.3.2/Mod..._2.ips
windows10-2004-x64
1v1.3.2/Mod...DS.bin
windows7-x64
1v1.3.2/Mod...DS.bin
windows10-2004-x64
1v1.3.2/Mod...DS.bin
windows7-x64
1v1.3.2/Mod...DS.bin
windows10-2004-x64
1v1.3.2/Mod..._2.ips
windows7-x64
1v1.3.2/Mod..._2.ips
windows10-2004-x64
1v1.3.2/Mod..._2.ups
windows7-x64
1v1.3.2/Mod..._2.ups
windows10-2004-x64
1v1.3.2/Mod..._2.ips
windows7-x64
1v1.3.2/Mod..._2.ips
windows10-2004-x64
1v1.3.2/Pok...on.zip
windows7-x64
1v1.3.2/Pok...on.zip
windows10-2004-x64
1Guides & D..._2.txt
windows7-x64
1Guides & D..._2.txt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 19:47
Static task
static1
Behavioral task
behavioral1
Sample
v1.3.2-20240227T194641Z-001.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
v1.3.2-20240227T194641Z-001.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
v1.3.2/Guides & Documentation/New Evolutions v1_3_2.txt
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
v1.3.2/Guides & Documentation/New Evolutions v1_3_2.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
v1.3.2/Guides & Documentation/Patching & Additional Mods Guide.txt
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
v1.3.2/Guides & Documentation/Patching & Additional Mods Guide.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
v1.3.2/Guides & Documentation/Pokémon Availability v1_3_2.png
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
v1.3.2/Guides & Documentation/Pokémon Availability v1_3_2.png
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
v1.3.2/Guides & Documentation/Postgame Guide.docx
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
v1.3.2/Guides & Documentation/Postgame Guide.docx
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
v1.3.2/Guides & Documentation/Regression Shard Locations v1_3_2.txt
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
v1.3.2/Guides & Documentation/Regression Shard Locations v1_3_2.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
v1.3.2/Guides & Documentation/TM Locations v1_3_2.txt
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
v1.3.2/Guides & Documentation/TM Locations v1_3_2.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
v1.3.2/Guides & Documentation/Wild Pokémon Guide v1_3_2.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
v1.3.2/Guides & Documentation/Wild Pokémon Guide v1_3_2.xlsx
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/3DS Save Fix Patch v1_3_2.ips
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/3DS Save Fix Patch v1_3_2.ips
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/banner data for 3DS.bin
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/banner data for 3DS.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/icon data for 3DS.bin
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
v1.3.2/Mods & Patches/3DS Stuff (GBA VC doesn_t work atm)/icon data for 3DS.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
v1.3.2/Mods & Patches/Lag Fix Removal Saiph 2 v1_3_2.ips
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
v1.3.2/Mods & Patches/Lag Fix Removal Saiph 2 v1_3_2.ips
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
v1.3.2/Mods & Patches/Time Based Removal Patch v1_3_2.ups
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
v1.3.2/Mods & Patches/Time Based Removal Patch v1_3_2.ups
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
v1.3.2/Mods & Patches/Vigilante Mode Patch v1_3_2.ips
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
v1.3.2/Mods & Patches/Vigilante Mode Patch v1_3_2.ips
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
v1.3.2/Pokémon Saiph 2 Full Release v1_3_2 by Vytron.zip
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
v1.3.2/Pokémon Saiph 2 Full Release v1_3_2 by Vytron.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Guides & Documentation/New Evolutions v1_3_2.txt
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Guides & Documentation/New Evolutions v1_3_2.txt
Resource
win10v2004-20240226-en
General
-
Target
v1.3.2/Guides & Documentation/Postgame Guide.docx
-
Size
15KB
-
MD5
042849f98d26466332289bb169b30e4a
-
SHA1
97d922860bd434c931c73c395ede05c52f0be42d
-
SHA256
3b96e98b8f9f09af9b4f9ff554441674058ffba87d343d6871be05b6ff9b7d82
-
SHA512
40e5adeea1d39aa657af52a464c3ab2cb3808eeb884d4d2407b7718de9fbe95d50571ecf325a296314cc0dd73d82ca660613e26e999a0d16a5a97912fd3b95e6
-
SSDEEP
192:jh4tkW1Kco9iqizOsEnK43K8yB4ilXUekeYnPJcgoQWoDgU:d05XqizO1KP9zktnhcPQWU
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4760 WINWORD.EXE 4760 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\v1.3.2\Guides & Documentation\Postgame Guide.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84