fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.bin
Size 140B
Sample240302-2lcnbsae44
SHA256 b77b80e5f9dbd14fb9c20bfe9643e8a8fec147807ed59b8fbf6a0116264a498a
MD5 23c1f2aad9e5efd1646a3022dec6cca1
SHA1 0f158db17e73f7b85f61cdcc93a4eb7104956532
SHA512 d0fb4cfbb3099354ae4036f1c0be3c8b2758a9d32ee3c7ab80d583fc0970158d82bed98d594a12ab5360ce5f54fe775e6a983151264d1167cc20ca122c84b79c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.bin	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\bin_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	AcroRd32.exe
2552	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3068	3008	cmd.exe	29
PID 3008 wrote to memory of 3068	3008	cmd.exe	29
PID 3008 wrote to memory of 3068	3008	cmd.exe	29
PID 3068 wrote to memory of 2552	3068	rundll32.exe	30
PID 3068 wrote to memory of 2552	3068	rundll32.exe	30
PID 3068 wrote to memory of 2552	3068	rundll32.exe	30
PID 3068 wrote to memory of 2552	3068	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Profile\IGGGAMES\Stats\Stats.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 48aae7af1875a15a8d98bde7951422940acba36cc628316cda577f6e5700f6a9
MD5 132bd4e66f21f6394c5dcd0260adcbb5
SHA1 248fbfa4fbdbaf23e10ad337698040cf952325f6
SHA512 a9bf1e4573a07d6df287abaaf503aeb7aa599dacc55bb5964142f102d54d25251455e926fc3a587e69e8d3c20c0eeb62539faa81efcc872e7e101c03d378d486
MD5 SHA1 SHA512

Submit Download