a31d8ceb94c34d5900c7ba6c4f7d4789034d955062e0b372a2029d1761346a5a

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FIFA 2005_Repack_v2_Setup-1.bin
Size

988.8MB
MD5

1cc6cf2189f1d305dc1a9923673ec6e7
SHA1

f2ed0107101014f2d7c0641134a872db6d423bb6
SHA256

efdba22e65e6a99b5407ffcc0217db31acc26fbdb20612d4049769b45dc42dd8
SHA512

96d9a8d394519fd1b86315e561e931a0f26f0098e7b1d0662db3312f81ca45ff82447cfc2ab47ac811e5994aefbc53d4a83da9fb318a66874519788481d3fa40
SSDEEP

25165824:oBppOy18XLSIThhQ+UNmxHq9CzhtKQpfOjlrEdHkg:oB/f18XUeHq9q2tjkHkg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.bin	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\bin_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.bin\ = "bin_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2484	2720	cmd.exe	29
PID 2720 wrote to memory of 2484	2720	cmd.exe	29
PID 2720 wrote to memory of 2484	2720	cmd.exe	29
PID 2484 wrote to memory of 2872	2484	rundll32.exe	30
PID 2484 wrote to memory of 2872	2484	rundll32.exe	30
PID 2484 wrote to memory of 2872	2484	rundll32.exe	30
PID 2484 wrote to memory of 2872	2484	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FIFA 2005_Repack_v2_Setup-1.bin"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FIFA 2005_Repack_v2_Setup-1.bin
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FIFA 2005_Repack_v2_Setup-1.bin"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ffc4bc5197931842adb1422172f38cf1

SHA1
59c70fedd3aadba463f51dd0f14800d3f62ab706

SHA256
6320b0fd08251b7d7b6a423bbe2fed9880c3c1f2931389b29bebb0400c06f58f

SHA512
9560c5526573201b335a1a10559e18f02691a1c37eda15c0bf8e64255c2da62c3f02119559cac7d7270d0bf2a375bc0025d2fa5aba652ad17c472249f5f60537

Download Submit