Overview

overview

4

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-1703-x64

4

https://cdn.discorda...

windows10-2004-x64

1

https://cdn.discorda...

windows11-21h2-x64

1

Analysis

  • max time kernel
    98s
  • max time network
    93s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/06/2024, 17:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://cdn.discordapp.com/attachments/1193268220015153298/1257017374381572220/Funni_Game_1.zip?ex=6682e028&is=66818ea8&hm=290da57df7d70760983939df2c9f9eb947878930aa65a3109b8005881fd09c3b&
  • Sample240630-vv41lsvbpm
Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://cdn.discordapp.com/attachments/1193268220015153298/1257017374381572220/Funni_Game_1.zip?ex=6682e028&is=66818ea8&hm=290da57df7d70760983939df2c9f9eb947878930aa65a3109b8005881fd09c3b&"
    1⤵
      PID:4684
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:992
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:196
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4380
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2244
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3656
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2128
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2276
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4172
      • C:\Windows\System32\SystemSettingsBroker.exe
        C:\Windows\System32\SystemSettingsBroker.exe -Embedding
        1⤵
          PID:5028
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:2924
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
            1⤵
              PID:4388
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
              1⤵
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s RasMan
              1⤵
                PID:4412
              • C:\Users\Admin\AppData\Local\Temp\Temp1_Funni Game (1).zip\Funni Game.exe
                "C:\Users\Admin\AppData\Local\Temp\Temp1_Funni Game (1).zip\Funni Game.exe"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:2932
              • C:\Users\Admin\Downloads\Funni Game (1)\Funni Game.exe
                "C:\Users\Admin\Downloads\Funni Game (1)\Funni Game.exe"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:2476
              • C:\Users\Admin\Downloads\Funni Game (1)\Funni Game.exe
                "C:\Users\Admin\Downloads\Funni Game (1)\Funni Game.exe"
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:3536

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    edgecompatviewlist[1].xml
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml
                    • Size 74KB
                    • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Funni%20Game%20(1)[1].zip
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PXKUCEFM\Funni%20Game%20(1)[1].zip
                    • Size 29.0MB
                    • SHA256 8ee9b22b75f390d5c570d5c2f57a0aa21328f79308ee8b3cb87ebfa43669be9b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    suggestions[1].en-US
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RUKV4CIT\suggestions[1].en-US
                    • Size 17KB
                    • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Funni%20Game%20(1)[1].zip
                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PXKUCEFM\Funni%20Game%20(1)[1].zip
                    • Size 78KB
                    • SHA256 ee3f3510f161401e041d8c77150fd1aedbc699e75f65f20efe07f3666214f8bf
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Z7KMKU3H.cookie
                    • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Z7KMKU3H.cookie
                    • Size 223B
                    • SHA256 3a33924c64519b0fea61d3eb15c5ec1d9fadc5d0a9e3272a3fe0814f1e76a8f0
                    • MD5 SHA1 SHA512
                    Submit Download

                    godot.log
                    • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\njo;\logs\godot.log
                    • Size 304B
                    • SHA256 117cec9bd537a8acb332343f7dd406bdc969a74fc543cf234b82f0988be2ed39
                    • MD5 SHA1 SHA512
                    Submit Download

                    netrasa.PNF
                    • Path C:\Windows\INF\netrasa.PNF
                    • Size 22KB
                    • SHA256 8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    memory/992-130-0x00000275E50A0000-0x00000275E50A1000-memory.dmp
                    Download

                    memory/992-121-0x00000275E6600000-0x00000275E74C2000-memory.dmp
                    Download

                    memory/992-129-0x00000275E5090000-0x00000275E5091000-memory.dmp
                    Download

                    memory/992-16-0x00000275DE920000-0x00000275DE930000-memory.dmp
                    Download

                    memory/992-35-0x00000275DBE60000-0x00000275DBE62000-memory.dmp
                    Download

                    memory/992-0-0x00000275DE820000-0x00000275DE830000-memory.dmp
                    Download

                    memory/2128-75-0x0000028238E10000-0x0000028238F10000-memory.dmp
                    Download

                    memory/2244-45-0x0000029BD3D80000-0x0000029BD3E80000-memory.dmp
                    Download

                    memory/2476-123-0x00007FF758AA0000-0x00007FF75DC30000-memory.dmp
                    Download

                    memory/2932-118-0x00007FF73AC00000-0x00007FF73FD90000-memory.dmp
                    Download

                    memory/3536-156-0x00007FF758AA0000-0x00007FF75DC30000-memory.dmp
                    Download

                    memory/3656-64-0x0000018D199E0000-0x0000018D199E2000-memory.dmp
                    Download

                    memory/3656-59-0x0000018D195E0000-0x0000018D195E2000-memory.dmp
                    Download

                    memory/3656-62-0x0000018D199C0000-0x0000018D199C2000-memory.dmp
                    Download

                    memory/3656-57-0x0000018D19C00000-0x0000018D19D00000-memory.dmp
                    Download