Analysis
-
max time kernel
55s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-it -
resource tags
arch:x64arch:x86image:win10v2004-20240508-itlocale:it-itos:windows10-2004-x64systemwindows -
submitted
27-06-2024 20:04
Behavioral task
behavioral1
Sample
release-1.rar
Resource
win10v2004-20240508-it
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral2
Sample
release/main/cheat.exe
Resource
win10v2004-20240508-it
windows10-2004-x64
9 signatures
600 seconds
Behavioral task
behavioral3
Sample
release/main/loader.exe
Resource
win10v2004-20240508-it
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral4
Sample
release/map/map.exe
Resource
win10v2004-20240611-it
windows10-2004-x64
13 signatures
600 seconds
Behavioral task
behavioral5
Sample
release/readme.txt
Resource
win10v2004-20240508-it
windows10-2004-x64
1 signatures
600 seconds
General
-
Target
release-1.rar
-
Size
11.5MB
-
MD5
2193b6604f588f357d740a18bdab44f4
-
SHA1
76f47e39d4f2519c2cf0286f32f6dbe6750058c1
-
SHA256
16c7a73b769a3cd125d7954c8a2f9e00899b24d1ff8141e7f4ccb4e57119bac1
-
SHA512
cd681225749e199689369aed7a3beb96cd7137a9d052a9b7d753d61906b4187da5696364d31b37b5d2453ae344b6fb5c7fc872a1ac9e43b20a3442a30bdbb193
-
SSDEEP
196608:viS/BJrAwImyJd7fRMEef/KIMxAvGUFi0gpuKLoqizxw139o3IVTiypXyGF:vigrAdmATje3DAA+UA0gxLonzm9o3IB5
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4260 taskmgr.exe Token: SeSystemProfilePrivilege 4260 taskmgr.exe Token: SeCreateGlobalPrivilege 4260 taskmgr.exe Token: 33 4260 taskmgr.exe Token: SeIncBasePriorityPrivilege 4260 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe 4260 taskmgr.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3268 OpenWith.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe 3136 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 3136 3268 OpenWith.exe 87 PID 3268 wrote to memory of 3136 3268 OpenWith.exe 87 PID 3268 wrote to memory of 3136 3268 OpenWith.exe 87 PID 3136 wrote to memory of 2432 3136 AcroRd32.exe 90 PID 3136 wrote to memory of 2432 3136 AcroRd32.exe 90 PID 3136 wrote to memory of 2432 3136 AcroRd32.exe 90 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 4964 2432 RdrCEF.exe 93 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94 PID 2432 wrote to memory of 3016 2432 RdrCEF.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\release-1.rar1⤵
- Modifies registry class
PID:3704
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\release-1.rar"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35CAEADD5DE089F56D5CFAA76D612387 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4964
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DD42F49F848BE139B84FEE9AE8E84A22 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DD42F49F848BE139B84FEE9AE8E84A22 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:14⤵PID:3016
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=026383F0C38CFB2B0FD13293D06409C4 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=84A47353202C5EFDC6570191DAA8B1EA --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4368
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3808
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260