7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
118s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RJ01082861-PC/www/audio/bgm/BGM_Junai1_Hinaso.rpgmvo
Size

6.7MB
MD5

b778d5747c13b15b40a35152d2b83ade
SHA1

67e124040d300e47c3410eb86d04af40dc5eb2f9
SHA256

5ad8fe6e3d397a62a00c4e18bb25c19cf0417d97a95608d67d326fba3055e87b
SHA512

b9a37fcc461cc05572e5c728c57d5fc2be65180e777cee798c3abe9a4c88c29e9cbfea9ae7aa111ec2fb238578421073bc4133462cb1c02210f870c10ce8eb20
SSDEEP

98304:r8q2u6yyCaCJtRLnVOOzPVvYw9ayTJUX2Mw/UrkRS7L/ec7S4hAa+gUWehrYk:QFuPyV87EORN1TJ7Mw/rcv/ec5sNYk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.rpgmvo	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.rpgmvo\ = "rpgmvo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\rpgmvo_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
840	AcroRd32.exe
840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2740	2988	cmd.exe	29
PID 2988 wrote to memory of 2740	2988	cmd.exe	29
PID 2988 wrote to memory of 2740	2988	cmd.exe	29
PID 2740 wrote to memory of 840	2740	rundll32.exe	30
PID 2740 wrote to memory of 840	2740	rundll32.exe	30
PID 2740 wrote to memory of 840	2740	rundll32.exe	30
PID 2740 wrote to memory of 840	2740	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\www\audio\bgm\BGM_Junai1_Hinaso.rpgmvo
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\www\audio\bgm\BGM_Junai1_Hinaso.rpgmvo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\www\audio\bgm\BGM_Junai1_Hinaso.rpgmvo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
87cdbb83220da5f80040f1168975c4f3

SHA1
956784885bcfb94629b12f056c3a52f1f99a177a

SHA256
9a4db8d0029aa70900fec394d729de890ccdba21550a18989c5b9fe5973ec56d

SHA512
6bfae45005ed05bc50e3cf4e03b5e7d30dbd552e28df3b94389b9ebd5719474fc7cc576547da4d6da40ce44385f1e633b99bfe7c5af02caaaaafb6915fe58954

Download Submit