babb6603ef3db2a4394ad8ea40c6373245dad6604bee7481383acd003cf9f70a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Burai Fighter Deluxe (US).gb
Size

64KB
MD5

dd5aa6e85827a3ce6e4b7500e75a3262
SHA1

178e18b7e6e65e726b4e06f80d89c55332ea868b
SHA256

704c24466e0f92e280073af3191dae54b842a8736281c697f8c9d1f35f91b065
SHA512

bafb7d6daaf34cb7669d1ebe9f34f9b6ba49e31f2cc2468d72af1bc2526f9d39fdfd0b3e1b39fcb961e6ab36c6c412dcf91077759071d343b35dd36c830986a1
SSDEEP

768:FJ6P3qJ4/MYU3dQ+XFMBsKxK5k1kI7pkF6MvygyGUQHnJQiQ8:aP3x+NQ+qWxkclrUAb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.gb\ = "gb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.gb	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\gb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 1644 wrote to memory of 2604	1644	cmd.exe	29
PID 2604 wrote to memory of 2512	2604	rundll32.exe	30
PID 2604 wrote to memory of 2512	2604	rundll32.exe	30
PID 2604 wrote to memory of 2512	2604	rundll32.exe	30
PID 2604 wrote to memory of 2512	2604	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Burai Fighter Deluxe (US).gb"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Burai Fighter Deluxe (US).gb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Burai Fighter Deluxe (US).gb"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7fabb8b3d3c51d71cf516ce1dbf854d7

SHA1
4b381e897e1f5a561ebd23e1bd1677e53feccdf8

SHA256
f4ccb0196056e3cddae05fe0afb6d933b4cc5dfdda5eb301c07c8920996f6e44

SHA512
23c29eb811c208fefca38322a7f912ee1412d759bcc67186cc30f619cb7bb1609c5ddd33df037345c569729a7d88d3b1cf10eb1d1b5cdc9822131b55f5529e93

Download Submit