b18f80f6538d66d54b579832b132bd95c11d6450929567291d332f13a70126a6

Analysis

max time kernel
104s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Street Fighter II Turbo (V1.0) (E) [!].smc
Size

2.5MB
MD5

dcf1834d348d7662e8126eaea38a988d
SHA1

35b72a3942851aac9c37da07bd39efe1a79e9071
SHA256

98d0b789a8a0c25bf82c777cba7289faa14365133cb7ea9d822005a1fdca3101
SHA512

6f8fb9bd3626b4c2a5a75b97849eb7dad12e7e8acaca6c65952484c25ce46d774968622c5cfc47110b82b3f3bde966a3654d9c52b66696ddac99699fb99f5ec3
SSDEEP

49152:MMza8FTezQ4fsMqMI2++SmPzCQTrErGShuobqRtHcsWY:1za8FTezQ4fsMqr2nJzCcrkrrbwtHnWY

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.smc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.smc\ = "smc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\smc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	AcroRd32.exe
2848	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2172	1320	cmd.exe	30
PID 1320 wrote to memory of 2172	1320	cmd.exe	30
PID 1320 wrote to memory of 2172	1320	cmd.exe	30
PID 2172 wrote to memory of 2848	2172	rundll32.exe	31
PID 2172 wrote to memory of 2848	2172	rundll32.exe	31
PID 2172 wrote to memory of 2848	2172	rundll32.exe	31
PID 2172 wrote to memory of 2848	2172	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Street Fighter II Turbo (V1.0) (E) [!].smc"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Street Fighter II Turbo (V1.0) (E) [!].smc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Street Fighter II Turbo (V1.0) (E) [!].smc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
67ea9a9b84a56c3ff67e5e40f55fc3d8

SHA1
21d8472c7983c2d2b7de2c01a404f6b649a7f168

SHA256
8f1a0449cc4d099e4c8fc794f8d5ab8cd49736d0fea68bde7c13457bcb62b2ad

SHA512
70fe5c157950f17512d1b0d97d8ab265afdc92ea9246819809f6b591e7c7d21ec3ed63e82f6533061fbe278eea50802ed464c9f60ffd8caecd775e14cb11ab4c

Download Submit