Overview
overview
7Static
static
7PS22PS4-GUI.exe
windows7-x64
1PS22PS4-GUI.exe
windows10-2004-x64
1bin/dlls/D...re.dll
windows7-x64
1bin/dlls/D...re.dll
windows10-2004-x64
1bin/dlls/D...60.dll
windows7-x64
1bin/dlls/D...60.dll
windows10-2004-x64
1bin/dlls/D...et.dll
windows7-x64
1bin/dlls/D...et.dll
windows10-2004-x64
1bin/dlls/D...ry.dll
windows7-x64
1bin/dlls/D...ry.dll
windows10-2004-x64
1bin/dlls/D...ms.dll
windows7-x64
1bin/dlls/D...ms.dll
windows10-2004-x64
1bin/dlls/H...ck.dll
windows7-x64
1bin/dlls/H...ck.dll
windows10-2004-x64
1bin/dlls/N...on.dll
windows7-x64
1bin/dlls/N...on.dll
windows10-2004-x64
1bin/dlls/l...et.dll
windows7-x64
1bin/dlls/l...et.dll
windows10-2004-x64
1bin/dlls/lzo.net.dll
windows7-x64
1bin/dlls/lzo.net.dll
windows10-2004-x64
1bin/dlls/n...rk.dll
windows7-x64
1bin/dlls/n...rk.dll
windows10-2004-x64
1bin/emulat...V2.pkg
macos-10.15-amd64
bin/tools/ext/di.exe
windows7-x64
1bin/tools/ext/di.exe
windows10-2004-x64
1bin/tools/...c9.dll
windows7-x64
1bin/tools/...c9.dll
windows10-2004-x64
3bin/tools/ext/sc.exe
windows7-x64
4bin/tools/ext/sc.exe
windows10-2004-x64
4bin/tools/gengp4.exe
windows7-x64
7bin/tools/gengp4.exe
windows10-2004-x64
7bin/tools/...ch.exe
windows7-x64
7Analysis
-
max time kernel
43s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 03:07
Behavioral task
behavioral1
Sample
PS22PS4-GUI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
PS22PS4-GUI.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
bin/dlls/DiscUtils.Core.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
bin/dlls/DiscUtils.Core.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
bin/dlls/DiscUtils.Iso9660.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
bin/dlls/DiscUtils.Iso9660.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
bin/dlls/DiscUtils.Net.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
bin/dlls/DiscUtils.Net.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
bin/dlls/DiscUtils.Registry.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
bin/dlls/DiscUtils.Registry.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
bin/dlls/DiscUtils.Streams.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
bin/dlls/DiscUtils.Streams.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
bin/dlls/HtmlAgilityPack.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
bin/dlls/HtmlAgilityPack.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
bin/dlls/Newtonsoft.Json.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
bin/dlls/Newtonsoft.Json.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
bin/dlls/lzfse-net.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
bin/dlls/lzfse-net.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
bin/dlls/lzo.net.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
bin/dlls/lzo.net.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bin/dlls/nunit.framework.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
bin/dlls/nunit.framework.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
bin/emulators/JakV2.pkg
Resource
macos-20240611-en
Behavioral task
behavioral24
Sample
bin/tools/ext/di.exe
Resource
win7-20240220-en
Behavioral task
behavioral25
Sample
bin/tools/ext/di.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
bin/tools/ext/libatrac9.dll
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
bin/tools/ext/libatrac9.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
bin/tools/ext/sc.exe
Resource
win7-20240508-en
Behavioral task
behavioral29
Sample
bin/tools/ext/sc.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral30
Sample
bin/tools/gengp4.exe
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
bin/tools/gengp4.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
bin/tools/gengp4_patch.exe
Resource
win7-20240220-en
General
-
Target
PS22PS4-GUI.exe
-
Size
340KB
-
MD5
91013483c99543a0aeec408933159f9f
-
SHA1
0db890c886f58fa1d61f643a7866460900f1de35
-
SHA256
0d79fa3f02b7bfc5950c6b0a210746fa2d5fd5e51fc7ee7e08851a0fce1a6df1
-
SHA512
5ff774054856900084b6bd40e4839fdbd6a64ac9db7a73b155757668347c2f55282738cb639e7ed5b2856b2c4a5f9c86906c1b314cecad2138a44f10defc498c
-
SSDEEP
6144:5EOSd8ybz1qMF1tdF/G4F1tdF/GA28Fs2k7TbqEANd0IF1tdF/G/:5EO7+hNd04Nd04s2kGEAgINd0/
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
PS22PS4-GUI.exepid process 3232 PS22PS4-GUI.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
PS22PS4-GUI.exepid process 3232 PS22PS4-GUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PS22PS4-GUI.execmd.exedescription pid process target process PID 3232 wrote to memory of 3040 3232 PS22PS4-GUI.exe cmd.exe PID 3232 wrote to memory of 3040 3232 PS22PS4-GUI.exe cmd.exe PID 3040 wrote to memory of 2056 3040 cmd.exe dotnet.exe PID 3040 wrote to memory of 2056 3040 cmd.exe dotnet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PS22PS4-GUI.exe"C:\Users\Admin\AppData\Local\Temp\PS22PS4-GUI.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c s.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes3⤵PID:2056
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550B
MD57c0ca124b478c82d12bc7b31098573a7
SHA16bd2dad140dc7f2baee34804ebf66868b0a20728
SHA2568d3fb6137fbe6c91f31cd9c01795736adfce7d0535c65dfa77160c85dc60e82f
SHA512b6fd96ee24b7d9f24dbb33c06b7f68fa14859f119280c1df45ee86f959dd3c4a4d8e1a544b645f0b6993a2679478ec3d00ef1a559cb8c19df7cf45b324f8812a
-
Filesize
30B
MD5d47abb0f1c515fa7ebf6adfe7fd941c0
SHA120ead5d2872e2831bc245ca3d34fc43f67775f70
SHA25607ae7cdd12c6ffdb1173fa5413b894e70ada7ed6f27f3e3d6999a29e6e0f8cf0
SHA512c93722740beeb71803d92777ffa3584710200291bf6e2bb6aa3f907f6d10b1a5f2e7eae74ff92d580fb66bb6963144c81430e31dff9232ad7a9074ff59bf53c2