Overview
overview
3Static
static
1savedgames.rar
windows7-x64
3savedgames.rar
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
savedgames.rar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
savedgames.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
savedgames/slot1/dlc01.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
savedgames/slot1/dlc01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
savedgames/slot1/dlc02.savegamedata
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
savedgames/slot1/dlc02.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
savedgames/slot1/dlc03.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
savedgames/slot1/dlc03.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
savedgames/slot1/dlc04.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
savedgames/slot1/dlc04.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
savedgames/slot1/dlc05.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
savedgames/slot1/dlc05.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
savedgames/slot1/dlc06.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
savedgames/slot1/dlc06.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
savedgames/slot1/dlc07.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
savedgames/slot1/dlc07.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
savedgames/slot1/dlc08.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
savedgames/slot1/dlc08.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
savedgames/slot1/dlc09.savegamedata
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
savedgames/slot1/dlc09.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
savedgames/slot1/dlc10.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
savedgames/slot1/dlc10.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
savedgames/slot1/game01.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
savedgames/slot1/game01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
savedgames/slot5/feopts01.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
savedgames/slot5/feopts01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
savedgames/slot5/global01.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
savedgames/slot5/global01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
savedgames/slot5/opts01.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
savedgames/slot5/opts01.savegamedata
Resource
win10v2004-20240802-en
General
-
Target
savedgames/slot1/dlc09.savegamedata
-
Size
58KB
-
MD5
6c170f7e298f61af3690013507c9a84e
-
SHA1
948e783985c17b49acaf9178877f61396900ab0d
-
SHA256
8fa6a341b20a084ca71f3c509d974534884c00bac161bff2556f67cbb67ec128
-
SHA512
8e799d0e226c4cc269894d85339d8f71b9c128840a489758b42262f455d3dd2233140520058136a84ca8d4ca94a821040662f9d2c63ea598a14a09c1381690cb
-
SSDEEP
24:yKWglQVLOovy33UlqHHh9zvYFk1TN5ANsRWsE4:yKWgWlOKyHUqHHhBvOklN5Ac1E4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.savegamedata\ = "savegamedata_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.savegamedata rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\savegamedata_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2852 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2852 AcroRd32.exe 2852 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2924 2420 cmd.exe 30 PID 2420 wrote to memory of 2924 2420 cmd.exe 30 PID 2420 wrote to memory of 2924 2420 cmd.exe 30 PID 2924 wrote to memory of 2852 2924 rundll32.exe 31 PID 2924 wrote to memory of 2852 2924 rundll32.exe 31 PID 2924 wrote to memory of 2852 2924 rundll32.exe 31 PID 2924 wrote to memory of 2852 2924 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\dlc09.savegamedata1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\dlc09.savegamedata2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\dlc09.savegamedata"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d3ed7d5d8260d3d8a342f50a63cb7536
SHA15f713385631d1f4fe3ad84ac7af742f1cd282aec
SHA2564eac7ee63c108debe51873c2c642930d15b7dccc3169a594b693ffa72baca7ee
SHA512cdc8ff72cd632656f6a45c04c1e8e2601038dfda74229687be55f2d3db31122c158e0e867a7ddfe45ca3e86d916bf3c73d03ee2a8f5893dbe147257a12d582a1