aff115f8f71d51ef13ef689352a654d66c88084622bb5c3f456b55c3e64556aa

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Yakuza-0-SteamRIP.com.torrent
Size

27KB
MD5

3aaad9b1386f373d7a6527448dcc787e
SHA1

a2d7a1ab64c5892e42d0052768f61f6698835179
SHA256

aff115f8f71d51ef13ef689352a654d66c88084622bb5c3f456b55c3e64556aa
SHA512

f2cb1100cbb299414823acc15e3f1732c3b38cf36acb72e55b39ba43e0abcabf26706fe4f4b58b4395a42bb0cc993419a2ccd839d1f23886df62261303dd2254
SSDEEP

768:ZGYethW5aAluRe8c6frUOPyWlbAVbt2tOKxbJdlOBtXO2hg:ZGBWgAluzrj6YAxt2tOQfr2e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.torrent	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.torrent\ = "torrent_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\torrent_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	AcroRd32.exe
2776	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2584 wrote to memory of 2776	2584	rundll32.exe	30
PID 2584 wrote to memory of 2776	2584	rundll32.exe	30
PID 2584 wrote to memory of 2776	2584	rundll32.exe	30
PID 2584 wrote to memory of 2776	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Yakuza-0-SteamRIP.com.torrent
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Yakuza-0-SteamRIP.com.torrent
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Yakuza-0-SteamRIP.com.torrent"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f4baddd29fd0f4af53eb0ae07661cb1

SHA1
485ca36887d1f6f2ce6343225b54a34fff208189

SHA256
b23017a882cd8e5e9abf2780d53250d8a4579be057b3f9976a3a0a1d948c4739

SHA512
15df6c20718cbf2ab74da5463c583c076667891a3c868fa6b1e27b09447d2e6be61dfd2c93b401431b2d202354d9951b4635de0a9c2e440efbdba808df683479

Download Submit