e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
1791s
max time network
1575s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11-04-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dolphin.exe
Size

14.9MB
MD5

9660ec7cddf093a1807cb25fe0946b8e
SHA1

5986661c62d689380476db238d7c18fa37d1b616
SHA256

19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66
SHA512

5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755
SSDEEP

196608:HgfH5UoUTKklTNrDatogipuoBvfU2+YOcfyOGXutM8/:A/5UomlTNMogipuoBvfU2bOevGeP/

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3832	Dolphin.exe
3832	Dolphin.exe
3832	Dolphin.exe
3832	Dolphin.exe

C:\Users\Admin\AppData\Local\Temp\Dolphin.exe
"C:\Users\Admin\AppData\Local\Temp\Dolphin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3832

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000000701F4 /startuptips
1⤵
PID:4560

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
3014f178885d19a592fc85979fdb817c

SHA1
8774f80895ef6750ad04fe2f2b8c86fa10ff69f7

SHA256
e0bf7a40cb631a3ddbe03aabc49c81c83f223f015c022aba17e8f3999d9402c5

SHA512
17ed8d09d4c2bdf7b303d9236002aac76fa717b0dbc222beea60c7fa5dc2a6bc2830e112982d835369bc2bbf4278de2952cc6ba9171dce34efe7e1c98befbddf

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
8626b507f3066ea01ecd7dd61b8462c3

SHA1
1c3e6049d7efb19ec81610e6683faa4e6efc4200

SHA256
d900cb4d3e8c42df3ecdd7217042c3ea5edaac52df4f006c5dbd2617c54c8a69

SHA512
72a2934bb6fe7318355bbe94a6ca64834c36c4c9d09e5b35c0c40187bea0d9170906eac4a1fa3a13ef7a7b8931f20272a7c60a6a95287a32cc085f1af086ea8d

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/3832-49-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download