Overview
overview
3Static
static
1savedgames.rar
windows7-x64
3savedgames.rar
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3savedgames...medata
windows7-x64
3savedgames...medata
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
savedgames.rar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
savedgames.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
savedgames/slot1/dlc01.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
savedgames/slot1/dlc01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
savedgames/slot1/dlc02.savegamedata
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
savedgames/slot1/dlc02.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
savedgames/slot1/dlc03.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
savedgames/slot1/dlc03.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
savedgames/slot1/dlc04.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
savedgames/slot1/dlc04.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
savedgames/slot1/dlc05.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
savedgames/slot1/dlc05.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
savedgames/slot1/dlc06.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
savedgames/slot1/dlc06.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
savedgames/slot1/dlc07.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
savedgames/slot1/dlc07.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
savedgames/slot1/dlc08.savegamedata
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
savedgames/slot1/dlc08.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
savedgames/slot1/dlc09.savegamedata
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
savedgames/slot1/dlc09.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
savedgames/slot1/dlc10.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
savedgames/slot1/dlc10.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
savedgames/slot1/game01.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
savedgames/slot1/game01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
savedgames/slot5/feopts01.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
savedgames/slot5/feopts01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
savedgames/slot5/global01.savegamedata
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
savedgames/slot5/global01.savegamedata
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
savedgames/slot5/opts01.savegamedata
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
savedgames/slot5/opts01.savegamedata
Resource
win10v2004-20240802-en
General
-
Target
savedgames/slot1/game01.savegamedata
-
Size
350KB
-
MD5
e0ced6a746d0cfedcfcf3675fc6a46e6
-
SHA1
84364e1205aa34f32eeb7e4569f86f5f0b3699be
-
SHA256
94474cb64862312f09df08c1ba1e4f78260d4083b0b85953ecd205f51b1c5e48
-
SHA512
7efd766900daad15dc6bed28dac008d35a144549f6c0b9a886822a057b8e42e80dab612034ff3f6a267ce782303e22ee89b5ffcf56002c3fdf42d9d80f78ee5f
-
SSDEEP
1536:0Wfjf8akDtQFT0XSWwZCyWfjf8akDtQFT0XSWwZCyWfjf8akDu:BlT0XSWjlT0XSWjB
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.savegamedata rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.savegamedata\ = "savegamedata_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\savegamedata_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2904 2872 cmd.exe 29 PID 2872 wrote to memory of 2904 2872 cmd.exe 29 PID 2872 wrote to memory of 2904 2872 cmd.exe 29 PID 2904 wrote to memory of 2524 2904 rundll32.exe 30 PID 2904 wrote to memory of 2524 2904 rundll32.exe 30 PID 2904 wrote to memory of 2524 2904 rundll32.exe 30 PID 2904 wrote to memory of 2524 2904 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\game01.savegamedata1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\game01.savegamedata2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\game01.savegamedata"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD510b183601c737d6f9252b08872df2ba0
SHA1454c9d1b07e74a8f31cd320e605da5c3bd033306
SHA256e9433060349d356bfa4b411d02423c1cf11d1ae3f22e755b38fa6de645a90c7a
SHA5125d6b15bd211fd5c2bb944323d65e16ca2cb8ff98e4c79a61bc7d7183cec5aa86476038a928fa170416fe73b4b12d4d9c38f6cf8068d332cdc796a74d8013fa83