e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
1791s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11-04-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dolphin.exe
Size

14.9MB
MD5

9660ec7cddf093a1807cb25fe0946b8e
SHA1

5986661c62d689380476db238d7c18fa37d1b616
SHA256

19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66
SHA512

5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755
SSDEEP

196608:HgfH5UoUTKklTNrDatogipuoBvfU2+YOcfyOGXutM8/:A/5UomlTNMogipuoBvfU2bOevGeP/

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	Dolphin.exe
2384	Dolphin.exe
2384	Dolphin.exe
2384	Dolphin.exe

C:\Users\Admin\AppData\Local\Temp\Dolphin.exe
"C:\Users\Admin\AppData\Local\Temp\Dolphin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 0000000000090030 /startuptips
1⤵
PID:4976

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
0c0018803d4228c7382da3688fa1fb8c

SHA1
6bacf4449d20376a78e3eaa1f8434d4e9a2e06f5

SHA256
69753728587571039e6ebc3025e3256e305bc3a3e36eff9b4c8b3ff01a310aad

SHA512
2a77c47b45efb61e26d5af310105f0bb3704bf1b29af9daf496cf9a31e761c5574392e66f54c5d0ec20929ed2d4a7bba03f6a3672c3fdea27223b1bd6d839ab1

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
39ca76e2b6ce13299e30768019b83bd3

SHA1
0172350dee714749a928119bb2b69bf516f050b7

SHA256
5a189b1da39726108ac310684a4e774ff25795e551bc3938105cbe75dbce8f95

SHA512
79a3b37382ffb754b400a9575a1096c73d9f74fcf4e06cc515d1faf774da9d6c0bf85d49003c37578a94acd143c712c3c95013e135f4e5d142a52f356b36e8d8

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/2384-49-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download