bb76d76af8aeb847aa6ba37f3eed8cd71a5c3824d624e7115ca1ecd56a3d68b7

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lethal Company/Lethal Company/BepInEx/cache/chainloader_typeloader.dat
Size

7KB
MD5

5044be3081b06dbdc0b9306e3b87dc07
SHA1

94ab84f113c677edbfe363c68318f2fed55da189
SHA256

73287f62ad31c516d2ed93ddbd0455421b514f4b74e4b33d62fe88f9a3777014
SHA512

99b875289edf9304795c85a053406b28a1255cf347ae41d5a9f7c4b8d97b5aac29f23a04e98fa8c91b92568759ebc772cf066e173d2f67cd7fc905f4f8cb8e1a
SSDEEP

96:WhYf+RK3ZlNlKUxPi4L1MRQQXMnbMup3/mKG6ZIeFQ8SMVmEx6Cn:3fCKJPQUxPlMGPnb5pOK5FhSims6Cn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.dat	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	AcroRd32.exe
2476	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2568	1744	cmd.exe	29
PID 1744 wrote to memory of 2568	1744	cmd.exe	29
PID 1744 wrote to memory of 2568	1744	cmd.exe	29
PID 2568 wrote to memory of 2476	2568	rundll32.exe	30
PID 2568 wrote to memory of 2476	2568	rundll32.exe	30
PID 2568 wrote to memory of 2476	2568	rundll32.exe	30
PID 2568 wrote to memory of 2476	2568	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\cache\chainloader_typeloader.dat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\cache\chainloader_typeloader.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\cache\chainloader_typeloader.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
083bb016d7a1b98ecacd6f497f33d5fc

SHA1
e0fc6623021fc75228a78d195c0845bac08a2f98

SHA256
29ebd0b1777a3a765e753ab591f45461c1535ca176abce7b1468f12be9e29ece

SHA512
73758a28d698851a211c4fdca143a0a280c03cdb8409ad1337f33d35ec081d019d9ae0d4f16e5a4268f477e61ee33f741f8e422aa804b767803fa4917f18aa73

Download Submit