b95106de4cce90d9ed2ffbd3a10d63219834dd62b2ca84d0af1718961523eaa5

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fallout 2/critter.dat
Size

159.2MB
MD5

9b16e92ac88d168e81126b72e6f9ab3c
SHA1

4e01777a687f48726b1c0245554f2468a9c52f6e
SHA256

da83d615967c0bac41fbc50e6b86b3088401ff69ed9d8b2e5be1d6ac0c125bcd
SHA512

a2a6ab1d3d44899d66cbbc3a6b12c92473b429e1e7f313182d1e2360293bc950aaaebace71fc867da94c1903f24ccd6a624dd0939e0c6bcd8bacd9875d6f847f
SSDEEP

3145728:mJkzB+fs3U6Idcca43f3C5NtPSA95V/+ZrsM/AxMd60baB2YM7OMuseCvCD6XdO:cIUfs3pIdta43gNtP3Dt+eM/AxMdFbb8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.dat	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1276	1944	cmd.exe	29
PID 1944 wrote to memory of 1276	1944	cmd.exe	29
PID 1944 wrote to memory of 1276	1944	cmd.exe	29
PID 1276 wrote to memory of 2588	1276	rundll32.exe	30
PID 1276 wrote to memory of 2588	1276	rundll32.exe	30
PID 1276 wrote to memory of 2588	1276	rundll32.exe	30
PID 1276 wrote to memory of 2588	1276	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Fallout 2\critter.dat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Fallout 2\critter.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Fallout 2\critter.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d01c0ccac7369bbbf88e33eb8c676213

SHA1
519618bccce6431f3a52cb2452df9389daf8e234

SHA256
2969cc5f46d99f11d544cda7351fd1646c6040a5a2ee406115090e56107f44c5

SHA512
6ed59375eb3754d42c5de3cf135383db1675eeb682225e9c0501788856a0d4ba102c7d092373cfe70c03a0f1260d34cbdb34a5e12b68cea9bead65dd2f4932d4

Download Submit