f006540a62bc79c36f241ecb5b1c114e6933300e3d6b09e35e014660914bd845

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 14:14

Target

r2modman.exe
Size

120.6MB
MD5

450f62399b2decd69b51831469134546
SHA1

a2392cc7dcdd12ad851ce9f5ba72982d93563f46
SHA256

9c01490d325451e14945f50af46397177820f579d67c6412e2ef1335414d3639
SHA512

8c0a1c9f63422ab80a665ca482604182e5e4c1389e264e324c4b4aab4f8fcbad6eb7aa0827c6c5c9648c670d625bbc43d9aa0d708ea469afa09349b735ba92b2
SSDEEP

1572864:A1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:lasulbg8yTnbEOz

Score

1^/10

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\r2modman.exe\" \"%1\""	r2modman.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm	r2modman.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\URL Protocol	r2modman.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\ = "URL:ror2mm"	r2modman.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\shell\open\command	r2modman.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\shell	r2modman.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\ror2mm\shell\open	r2modman.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2320	r2modman.exe
2320	r2modman.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28
PID 2320 wrote to memory of 2788	2320	r2modman.exe	28

C:\Users\Admin\AppData\Local\Temp\r2modman.exe
"C:\Users\Admin\AppData\Local\Temp\r2modman.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\r2modman.exe
  "C:\Users\Admin\AppData\Local\Temp\r2modman.exe" --type=gpu-process --field-trial-handle=1048,15687584265270903613,5110744063640084526,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  PID:2788

memory/2320-3-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/2788-1-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download