bb76d76af8aeb847aa6ba37f3eed8cd71a5c3824d624e7115ca1ecd56a3d68b7

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lethal Company/Lethal Company/BepInEx/config/FlipMods.ReservedFlashlightSlot.cfg
Size

1KB
MD5

bc585efa4947b2506c7967d506c241e9
SHA1

0c33370d04a579d1f0b131347f242698f1f04a38
SHA256

bd125f7167caba4317f03328465b3e4216c6c94a44ce32f3585496a05d0356de
SHA512

9448ebffbe8a1bf0135e4580f7ace32d61a0da645b90e7b4de395e3c427ce7b499b334dbff1704b2f473db89237ca634a5afb6607c1cc496f8ff79d1ea02e327

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.cfg	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.cfg\ = "cfg_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\cfg_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2736	1820	cmd.exe	29
PID 1820 wrote to memory of 2736	1820	cmd.exe	29
PID 1820 wrote to memory of 2736	1820	cmd.exe	29
PID 2736 wrote to memory of 2784	2736	rundll32.exe	30
PID 2736 wrote to memory of 2784	2736	rundll32.exe	30
PID 2736 wrote to memory of 2784	2736	rundll32.exe	30
PID 2736 wrote to memory of 2784	2736	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\config\FlipMods.ReservedFlashlightSlot.cfg"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\config\FlipMods.ReservedFlashlightSlot.cfg
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\config\FlipMods.ReservedFlashlightSlot.cfg"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b80d82350981ed783e72c6ce0d6b336f

SHA1
0666aac0c0d4f4456b9f3b29031bf6b571795404

SHA256
8dac944720c722a0c0976d9ec347ed19de74b5886f0c946a48ea821df4cff815

SHA512
ccc4924902b62ab563b37345744599361b4c51006a66544c9762f782d37eb0d9e85aa23e6b1ea4809228975edab64566bbd1d58c91f300ffa2ba1da4647309ce

Download Submit