Overview
overview
3Static
static
3PSN LIBERA....1.rar
windows7-x64
3PSN LIBERA....1.rar
windows10-2004-x64
3PSN Liberator.exe
windows7-x64
3PSN Liberator.exe
windows10-2004-x64
1Tools/PKGD...AM.sfo
windows7-x64
3Tools/PKGD...AM.sfo
windows10-2004-x64
3Tools/PKGD...AM.sfo
windows7-x64
3Tools/PKGD...AM.sfo
windows10-2004-x64
3Tools/PKG_...ee.exe
windows7-x64
1Tools/PKG_...ee.exe
windows10-2004-x64
1Tools/PS3P...er.exe
windows7-x64
1Tools/PS3P...er.exe
windows10-2004-x64
1Tools/curl.exe
windows7-x64
1Tools/curl.exe
windows10-2004-x64
1Tools/cygwin1.dll
windows7-x64
1Tools/cygwin1.dll
windows10-2004-x64
1Tools/decr...ot.exe
windows7-x64
1Tools/decr...ot.exe
windows10-2004-x64
1Tools/dev_klics.txt
windows7-x64
1Tools/dev_klics.txt
windows10-2004-x64
1Tools/games.txt
windows7-x64
1Tools/games.txt
windows10-2004-x64
1Tools/genp....5.exe
windows7-x64
3Tools/genp....5.exe
windows10-2004-x64
3Tools/keys.conf
windows7-x64
3Tools/keys.conf
windows10-2004-x64
3Tools/klic...er.exe
windows7-x64
1Tools/klic...er.exe
windows10-2004-x64
1Tools/klics.txt
windows7-x64
1Tools/klics.txt
windows10-2004-x64
1Tools/klics/klic_free
windows7-x64
1Tools/klics/klic_free
windows10-2004-x64
1Analysis
-
max time kernel
107s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
PSN LIBERATOR V1.1.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PSN LIBERATOR V1.1.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
PSN Liberator.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
PSN Liberator.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Tools/PKGDIRUpdatesDiscTemplate/PS3_GAME/PKGDIR/PARAM.sfo
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Tools/PKGDIRUpdatesDiscTemplate/PS3_GAME/PKGDIR/PARAM.sfo
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Tools/PKGDIRUpdatesDiscTemplate/PS3_GAME/PKGDIR/PKGxx/PARAM.sfo
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Tools/PKGDIRUpdatesDiscTemplate/PS3_GAME/PKGDIR/PKGxx/PARAM.sfo
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Tools/PKG_KLicensee.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Tools/PKG_KLicensee.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Tools/PS3P_PKG_Ripper.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Tools/PS3P_PKG_Ripper.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Tools/curl.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Tools/curl.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Tools/cygwin1.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Tools/cygwin1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Tools/decrypt_eboot.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Tools/decrypt_eboot.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Tools/dev_klics.txt
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Tools/dev_klics.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Tools/games.txt
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Tools/games.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Tools/genps3iso_v2.5.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
Tools/genps3iso_v2.5.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
Tools/keys.conf
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Tools/keys.conf
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Tools/klic_bruteforcer.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Tools/klic_bruteforcer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Tools/klics.txt
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Tools/klics.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Tools/klics/klic_free
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Tools/klics/klic_free
Resource
win10v2004-20240709-en
General
-
Target
PSN Liberator.exe
-
Size
314KB
-
MD5
d5108e5bc400ca4945d17bc6b54531de
-
SHA1
f9f09477ef557535fec05c2bf560054f3be3e235
-
SHA256
c3f7df6b9fec2cc68474e248f46147e5393e77caef01ae965ca031f2330ff275
-
SHA512
ec6a8a090edeeb7e4cd7413df3e6b9dc716c6ef771feff81166570ffd68f49817f067a7f783faf2d591cc7e3bfc29a6cd3f2fe3a3a32ea71c8180e5a30aad511
-
SSDEEP
6144:7HasoY37Ah1/mMtTBeXs63wDWKBO8FyQ3iQzYRZz52QnBfQrWd0QPrOC4iDeYJ:7HasoYrAb/ntVZ63waKD3DzYRBB+Wd8r
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616193" PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 PSN Liberator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff PSN Liberator.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff PSN Liberator.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 PSN Liberator.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} PSN Liberator.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" PSN Liberator.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2432 PSN Liberator.exe