Analysis
-
max time kernel
129s -
max time network
133s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
-
submitted
04-05-2024 20:31
General
-
Target
YandereSimulatorLauncher.exe
-
Size
4.7MB
-
MD5
ab495cbad9cce547dc6b9d53d375305d
-
SHA1
558090bb37ad5d7eca7579268695363f380bf81e
-
SHA256
f4911aca41a0bf0a0aea29ef832965123d794bac2e8c6e9f36986f640c45f19b
-
SHA512
3e90c455ada7ad2eaeba31d330c875cb945babb55dce613aa900e1178438499eb4883e8f07bec760f621283daa3f6a41904a2e96bf70e10b7cf8a14091cff85b
-
SSDEEP
98304:ZRXG+U5FP7zOnKWjcghx10+HvYOumBfEzsTb6S6yhv1M9lc:5UzfOKWF3gOumBf/lbv69
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YandereSimulatorLauncher.exe"C:\Users\Admin\AppData\Local\Temp\YandereSimulatorLauncher.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD5bfd7ff1889337dcbd98ad4a781709240
SHA19efa2ae3cc1b3b1804699ac4a3d941282223a56e
SHA256169cd71ae6597d29ea7d9ac85caf83af5135247a8634260f77c36d899be77039
SHA51257ec5b714613b533b860503655ce2494ba2026e019c925886f89fd1c758d469080637131afc6f3202a0de2d2e77f7a3a1592ed8f9bb8e4101ba8ac4a383056de
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
2.5MB
MD542d071324f3a2d8ee2f67c49fded4f32
SHA12f91d68905ede16c22bdad2687f3df38641b2706
SHA25615d880ab2da5eecc1ea9d3349341eefd6d19118c772da1314ce09f1febb0df90
SHA512ccdf815463b30deb7c1d4afa292b0dc7735ce7218ce17d339bd8c103f2b72d1f59f50f0d9aee72c63bf6282dbea08cd8b00867c596150a16f04c2747e56e7577
-
Filesize
4.7MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
704KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB