e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
1791s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-04-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dolphin.exe
Size

14.9MB
MD5

9660ec7cddf093a1807cb25fe0946b8e
SHA1

5986661c62d689380476db238d7c18fa37d1b616
SHA256

19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66
SHA512

5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755
SSDEEP

196608:HgfH5UoUTKklTNrDatogipuoBvfU2+YOcfyOGXutM8/:A/5UomlTNMogipuoBvfU2bOevGeP/

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bcastdvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bcastdvr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3892	Dolphin.exe
3892	Dolphin.exe
3892	Dolphin.exe
3892	Dolphin.exe

C:\Users\Admin\AppData\Local\Temp\Dolphin.exe
"C:\Users\Admin\AppData\Local\Temp\Dolphin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3892

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 000000000009020A /startuptips
1⤵
PID:4316

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
7ef2368637659e888cf60e95f9d3d402

SHA1
d02e83eebd435716c4ecd68ebca3f79af28ec896

SHA256
472be14ad73a075c0a5c0ee293c02f8131d05a48b1a2bc1b6816f14340b7fc0e

SHA512
6892faf1e7ad2dae1d2e010df8c546ad4cf52b824e533e09a806ffd74649018fca0acd30aa7ad1ea40152604c11ea16cb957e0e4fc4b997864a8f7ac6f8670fd

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
e5580fa2d2dcd86ac95b1547d9364250

SHA1
421d36a9e63452b3c0d3abd7a7f7a09c64cab2e3

SHA256
b2b169b46e6e5c317b5ae16504c5e8cb0675b17435750d2035b3b6fb2a78fc0b

SHA512
e9bced3b684530e3dce5b302585eff2694da3e9f0eff2d74a3736d79f440d3192cec2dd3320589122239df2255978675a2e5283ab3a423809e42cf81305137a3

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/3892-49-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download