e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dolphin.exe
Size

14.9MB
MD5

9660ec7cddf093a1807cb25fe0946b8e
SHA1

5986661c62d689380476db238d7c18fa37d1b616
SHA256

19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66
SHA512

5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755
SSDEEP

196608:HgfH5UoUTKklTNrDatogipuoBvfU2+YOcfyOGXutM8/:A/5UomlTNMogipuoBvfU2bOevGeP/

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{7B232A1B-1215-43A1-AE24-D2A74908AB8B}	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2896	Dolphin.exe
2896	Dolphin.exe
2896	Dolphin.exe
2896	Dolphin.exe
1924	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Dolphin.exe
"C:\Users\Admin\AppData\Local\Temp\Dolphin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
01ebeb2142ae099c7e3406f49ce7ddd7

SHA1
c5a6888f3f2cba98eda7bd7d5caba10f7963fa23

SHA256
c2f0ff2098ed11bbf8ab9b52b948b713042431ad6ae2e0ff4814b0a632e008b1

SHA512
7074ac9e360f57380777cdff8fd42963aae13db27d9c3645b8c6d52a8075ef330ec6699b5462cd7437e14e3f002e9941a8bc1a0f8902c335cd6d58c20192ab2d

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
71f729d3dbb940f731f4302261748e6c

SHA1
caf41a041a23cd67e9da56a9a4c553ae9e8d1376

SHA256
9526f55a3aa15d3b5cfc684e0753b460ed2a95e09b759dfccc7cb406a3e809fb

SHA512
3534f8f3165325dceecbed70003b7fa06e078d7597f8e43e3e0971390fbdc1779ec7f5d6b1117c1b0eb7e93840faaee5e573a7d602579d1b7108ae0bf43425cd

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/2896-36-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download