5fadec9f010a5d113a77bf679677dc607588588405ece51a5aae9103f29f59be

Resubmissions

02/03/2024, 14:16

240302-rllwwsee273

02/03/2024, 14:14

240302-rkgwjseb5w3

02/03/2024, 14:07

240302-reyxwaed683

02/03/2024, 14:02

240302-rb72daed358

Analysis

max time kernel
110s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
undertale.sf2
Size 147.0MB
Sample240302-rb72daed35
SHA256 5fadec9f010a5d113a77bf679677dc607588588405ece51a5aae9103f29f59be
MD5 670f1159cd259d366cd89ad64503fd3a
SHA1 dda3d7804945603b07aad794db0e172b62edb015
SHA512 ce8b5c4d98d053e79cb662208a9a68bb3c1f60f84a9fe60c33acb59ae1adc96e99d430de21079e1914bf2fcd58ee782859c3468718153d24115d62ed0fee625c
SSDEEP 3145728:IWke6a/HKIO3JXQrM9vf4Uh4ztAOBa9n1UjXEeSNCnoMqZ07pr/KnmjDTzMM:IWVnPeFIwytAkcNCnZq8prisLL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\undertale.sf2
1⤵
- Modifies registry class
PID:4848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads