Overview
overview
3Static
static
3Lossless.S....9.rar
windows7-x64
3Lossless.S....9.rar
windows10-2004-x64
3Lossless S...es.txt
windows7-x64
1Lossless S...es.txt
windows10-2004-x64
1Lossless S...ss.dll
windows7-x64
1Lossless S...ss.dll
windows10-2004-x64
1Lossless S...ng.exe
windows7-x64
1Lossless S...ng.exe
windows10-2004-x64
1Lossless S...xe.xml
windows7-x64
1Lossless S...xe.xml
windows10-2004-x64
1Lossless S..._1.cso
windows7-x64
3Lossless S..._1.cso
windows10-2004-x64
3Lossless S..._2.cso
windows7-x64
3Lossless S..._2.cso
windows10-2004-x64
3Lossless S..._3.cso
windows7-x64
3Lossless S..._3.cso
windows10-2004-x64
3Lossless S..._4.cso
windows7-x64
3Lossless S..._4.cso
windows10-2004-x64
3Lossless S..._1.cso
windows7-x64
3Lossless S..._1.cso
windows10-2004-x64
3Lossless S..._2.cso
windows7-x64
3Lossless S..._2.cso
windows10-2004-x64
3Lossless S..._3.cso
windows7-x64
3Lossless S..._3.cso
windows10-2004-x64
3Lossless S..._4.cso
windows7-x64
3Lossless S..._4.cso
windows10-2004-x64
3Lossless S..._5.cso
windows7-x64
3Lossless S..._5.cso
windows10-2004-x64
3Lossless S..._6.cso
windows7-x64
3Lossless S..._6.cso
windows10-2004-x64
3Lossless S..._7.cso
windows7-x64
3Lossless S..._7.cso
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 17:31
Static task
static1
Behavioral task
behavioral1
Sample
Lossless.Scaling.2.9.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Lossless.Scaling.2.9.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Lossless Scaling 2.9/Licenses.txt
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Lossless Scaling 2.9/Licenses.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Lossless Scaling 2.9/Lossless.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Lossless Scaling 2.9/Lossless.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Lossless Scaling 2.9/LosslessScaling.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Lossless Scaling 2.9/LosslessScaling.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Lossless Scaling 2.9/LosslessScaling.exe.xml
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Lossless Scaling 2.9/LosslessScaling.exe.xml
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_1.cso
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_1.cso
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_2.cso
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_2.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_3.cso
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_3.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_4.cso
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_L_4.cso
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_1.cso
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_1.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_2.cso
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_2.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_3.cso
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_3.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_4.cso
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_4.cso
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_5.cso
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_5.cso
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_6.cso
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_6.cso
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_7.cso
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
Lossless Scaling 2.9/Shaders/ANIME4K_M_7.cso
Resource
win10v2004-20240508-en
General
-
Target
Lossless Scaling 2.9/Shaders/ANIME4K_M_5.cso
-
Size
5KB
-
MD5
0945483ae957aa27de5cac0c23356899
-
SHA1
9a478f84e5f6795ae2d4d0c0d3ffb571d266a21c
-
SHA256
daab56fcbaa24ee5f31e05925fbc51b2099d73b810c809b39ea569e391e81d5d
-
SHA512
d1005482e7e4ce0d48d4c706cbc53c381919ab6f89b07a001688798faba7ac1fae762adec71ac18fa9772efd1b74035125732ef925dac6908cdd229d078513eb
-
SSDEEP
96:XwSlDKeb07EXtNvfafU+EQXr/TnOe/9pZkwn7Ufob/7KHfP1lGEosf+7Na/cfd8i:LlRQ7sNve7/HZkwn7Ao/7K/P1lGXo+7N
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.cso rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.cso\ = "cso_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\cso_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2844 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2844 AcroRd32.exe 2844 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1420 wrote to memory of 1692 1420 cmd.exe rundll32.exe PID 1420 wrote to memory of 1692 1420 cmd.exe rundll32.exe PID 1420 wrote to memory of 1692 1420 cmd.exe rundll32.exe PID 1692 wrote to memory of 2844 1692 rundll32.exe AcroRd32.exe PID 1692 wrote to memory of 2844 1692 rundll32.exe AcroRd32.exe PID 1692 wrote to memory of 2844 1692 rundll32.exe AcroRd32.exe PID 1692 wrote to memory of 2844 1692 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Lossless Scaling 2.9\Shaders\ANIME4K_M_5.cso"1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lossless Scaling 2.9\Shaders\ANIME4K_M_5.cso2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lossless Scaling 2.9\Shaders\ANIME4K_M_5.cso"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d70e00e3605103b85b9c98c4ea12188a
SHA1f8056bf967a0fd3c5958aba0b03099af600b2610
SHA256332ef1f2ad6435d2403e87f1cdde99c679e62bb5fc8d819734bd2005c9de8b75
SHA512d2d9f1f1168a9c676b639814b6e71c8c5a9d0c4c9bc0b6649a4a9ecbaa45cd6b07575d4a98b1f555a7518d1ba8afd9bbcd8e9827fbc5e022e9feb5e5522c4f89