6d67a6b7b72220845abe6f3b798f509528e43de3afa798dcf36047996cc4a27e

Analysis

max time kernel
73s
max time network
87s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1/Yuka - Scattered Shards of the Yokai/locales/am.pak
Size 291KB
Sample240511-phgfwsae99
SHA256 2ea7267443a12217abd88714a9778655807670bcbe73864c678ebbd51afb52ec
MD5 25e65737fb40a1b1971ab7281353a059
SHA1 a60b41057883f2278d66764fb4f48310e946e49d
SHA512 08edd06d06db21c6354f3ae3b799f550ffe3d6debac215c51cda829b3b73b4ebbcea09fedc92ee946e6bd4687566e0b63c52e1027dacbc13d410ca9c864be413
SSDEEP 3072:Qcf6eZq5kkNWdpHC2ETGxDw7D/a7wSs6iidTlZdm+se90G/WPnexr9W2rvSWNJdm:blwcdsCpPHA52IuW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pak	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pak\ = "pak_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pak_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	AcroRd32.exe
2364	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2560	2500	cmd.exe	31
PID 2500 wrote to memory of 2560	2500	cmd.exe	31
PID 2500 wrote to memory of 2560	2500	cmd.exe	31
PID 2560 wrote to memory of 2364	2560	rundll32.exe	32
PID 2560 wrote to memory of 2364	2560	rundll32.exe	32
PID 2560 wrote to memory of 2364	2560	rundll32.exe	32
PID 2560 wrote to memory of 2364	2560	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\am.pak"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\am.pak
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\am.pak"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 096797f09dbd7e0d1bbad3bafcc5613b08ea2dbdd6afe0ea84f960f503707db8
MD5 1241489959cb6f88a088377d2355ba3f
SHA1 ada2dd6ff729941b4a17de129bc82a9a8f8fd134
SHA512 bc2d2c30919e24bc2a69a244e989cfb68e5b558530621ac62017b77ce5bf6243ca227b114a87142507465a623095b6876fc0546864c34e8154a16765fbe986d4
MD5 SHA1 SHA512

Submit Download