ff7259a49c7c9e5c28bb5da1c042f4ed008a96d11e5620dd1d89d0f997214574

Analysis

max time kernel
126s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM (1).exe
Size 5.0MB
Sample240613-bbsnpayakd
SHA256 ff7259a49c7c9e5c28bb5da1c042f4ed008a96d11e5620dd1d89d0f997214574
MD5 26daf242db283f9804ded57fa5f556e6
SHA1 26510e72901ac8b2c27ac0f6f6f4f10ff744a5c0
SHA512 48523b55925d5113d189f763d5669b2deb615c776810db326872a9a333949cbf31079c9046c37f3e50f103cb8464dcf2949611130fc2a6e5ac1589af0af320f8
SSDEEP 49152:iOjPW6H/UikolCdofyUS6cR7OPQksBH2BAl1mmReL9odoKklkEuFsO5f5B1w2jk3:tckvcR3fj3F7njSBwkChUNniRdhq
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
212	FiveM.exe
1640	FiveM_b2699_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{C632546C-A93A-45A3-B844-355D01A01D5E}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{42ACE696-7C98-4F9A-893C-1562A414E260}	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
212	FiveM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
212	FiveM.exe
5032	OpenWith.exe
212	FiveM.exe
212	FiveM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 212	2648	FiveM (1).exe	91
PID 2648 wrote to memory of 212	2648	FiveM (1).exe	91
PID 212 wrote to memory of 1640	212	FiveM.exe	102
PID 212 wrote to memory of 1640	212	FiveM.exe	102

C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Executes dropped EXE
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer" -dumpserver:2096 -parentpid:212
    3⤵
    - Executes dropped EXE
    PID:1640

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1468,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 6B
SHA256 b9feb5024071270715158aff61173eff9470ae7389a2d15ed14050358b2d7d51
MD5 fcf3493d4e6141a09a5545ec0e5755ca
SHA1 ff9f551c79a827965dcfedf1f16b94fadb6e2f3d
SHA512 4c1a75349e428cbcb77364bd6038606238d236846745ff3d05bcd91640cb4145a5c367a26deae84fb1d481f5b94a707e491bfc7ac925d3514358a544dc8209fc
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 1.8MB
SHA256 4de50d88d1aa69f45e5e0266d83e3a4297b8dc377cbc0e58214e733a1e3d9f0f
MD5 ae63da0d82569609d7a6d74c1f416670
SHA1 9095a1bc70f9930f444b9081f3e306c22da402b0
SHA512 8676592b8e4cff95a24b869a21fdc9c0754fab4c787ccd46a06fc5e0cfa215bb24dd0729d73b5c972e9b6ee4696958ae9a735491f347191e58f50d286ef87460
SSDEEP 49152:QNbJqB8smty55jRzVK8paoc/aeHBUxAW9hOWId:7vvcPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.1MB
SHA256 dc0118d2ee8119847b5acd4bb403bf5f37a11625491d0c2cd4f6058bb02cf06e
MD5 b2ed540e76b17be956cfc83bacf7da9d
SHA1 a6c636b9ba1b2ca5d669ef56708bc8ab39cfb15d
SHA512 783af30aa5791764c3590cb242cc9a882cf48464cd6cd5ceaa849ce8a1e19ee7f4432967480be0c5989d0e1a173de82ee0b4f004f10b8ca448e2dc3929ce5a00
SSDEEP 24576:fO4BKUuiEAJpjx/eb9ccWAATrMwhphc5661pJG:fO44U1EAJpheb92Atwhphc5661pJG
MD5 SHA1 SHA512 SSDEEP

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 1.9MB
SHA256 98c62f812d9e434f88000b0b22dadf029b0142e9bca452b8bc07a216d3d34687
MD5 bfb480a6c455072c020fbfc59045cf49
SHA1 bde1d63447a9387f854c1deca0d032283f6b525b
SHA512 6fe26fbaa694c26ddb51008f28ec637a4a921ad4e0dbb0e05ec0f0aa4dc6c3b7622c10e53cd4b3a5afc157b6ca87102f2eeceead11816d207e259aadffbe4959
SSDEEP 49152:tIMM5UHMregL0qeY9qFA6eNgtDBW8KvsK:uS7AKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
MD5 SHA1 SHA512

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 ff7259a49c7c9e5c28bb5da1c042f4ed008a96d11e5620dd1d89d0f997214574
MD5 26daf242db283f9804ded57fa5f556e6
SHA1 26510e72901ac8b2c27ac0f6f6f4f10ff744a5c0
SHA512 48523b55925d5113d189f763d5669b2deb615c776810db326872a9a333949cbf31079c9046c37f3e50f103cb8464dcf2949611130fc2a6e5ac1589af0af320f8
SSDEEP 49152:iOjPW6H/UikolCdofyUS6cR7OPQksBH2BAl1mmReL9odoKklkEuFsO5f5B1w2jk3:tckvcR3fj3F7njSBwkChUNniRdhq
MD5 SHA1 SHA512 SSDEEP

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 48377b963b4de9b3e3051108acd540d2ec762ee11668b2a90c48e4bb77b9e321
MD5 e2d60458fd1a0dc579340b48cdc6cdbf
SHA1 866edfbaa98b54f4bdfee3bd05d686c7a55ce375
SHA512 5297cea5e22873d51ef91dadcea47b6e2d45191be9525207ecd621ba104350e6efa65b14ee61c1ab2731e9a1dc41ca5fd0fdb627c96ebb8356edcda227dfd68e
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads