645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
internal/game/AI.lua
Size 1KB
Sample240719-npr1jascqa
SHA256 ea9c8d9600b9caf89e41a79179c29f4757caa12346f49b2b498ad37a1c13f4e2
MD5 41e9918bf7c6e12a5b74d4c434b6483f
SHA1 fea13f9221143521b5e78300e056f33587376e7b
SHA512 5ee3901b2d00337e904ae95377cc978738239d4ec549fbdca351e4e6d41a2228359bacb857e05f83c86168bede1c3fd57731b28e0fd26e6ba410da79ab54d67c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.lua	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.lua\ = "lua_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\lua_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2780	AcroRd32.exe
2780	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3044	3036	cmd.exe	32
PID 3036 wrote to memory of 3044	3036	cmd.exe	32
PID 3036 wrote to memory of 3044	3036	cmd.exe	32
PID 3044 wrote to memory of 2780	3044	rundll32.exe	33
PID 3044 wrote to memory of 2780	3044	rundll32.exe	33
PID 3044 wrote to memory of 2780	3044	rundll32.exe	33
PID 3044 wrote to memory of 2780	3044	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\internal\game\AI.lua
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\internal\game\AI.lua
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\internal\game\AI.lua"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 1ab9c262634314a4e8dfb74e13720f5caeda5221620c021d022c91bb6a26085e
MD5 83d6dd71ed66a4adc7a4bad2a729dbe9
SHA1 3c3b4e1e8482345541c762033f30034cb1e47251
SHA512 ee2ee26ce7467e826e64bd5ecf4f4df39f90937334d7a1b70459870f2c717f28d8e11498355432ff71c1052f0a58dd76225ef78cc823c4c06f90d1d3100f87a8
MD5 SHA1 SHA512

Submit Download