Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 22:39

General

  • Target

    Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin

  • Size

    140B

  • MD5

    23c1f2aad9e5efd1646a3022dec6cca1

  • SHA1

    0f158db17e73f7b85f61cdcc93a4eb7104956532

  • SHA256

    b77b80e5f9dbd14fb9c20bfe9643e8a8fec147807ed59b8fbf6a0116264a498a

  • SHA512

    d0fb4cfbb3099354ae4036f1c0be3c8b2758a9d32ee3c7ab80d583fc0970158d82bed98d594a12ab5360ce5f54fe775e6a983151264d1167cc20ca122c84b79c

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

          Filesize

          3KB

          MD5

          132bd4e66f21f6394c5dcd0260adcbb5

          SHA1

          248fbfa4fbdbaf23e10ad337698040cf952325f6

          SHA256

          48aae7af1875a15a8d98bde7951422940acba36cc628316cda577f6e5700f6a9

          SHA512

          a9bf1e4573a07d6df287abaaf503aeb7aa599dacc55bb5964142f102d54d25251455e926fc3a587e69e8d3c20c0eeb62539faa81efcc872e7e101c03d378d486