cb29f363b86d19778ab202835bb6faa40918de2e98cbfe1e315183e7a4a15515

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

custom/Aperture Tag Gun/materials/models/weapons/v_models/portalgun/goo_nrm.vtf
Size

1.3MB
MD5

fc7e7e147bb04c3392c23c15ad4e0d27
SHA1

e3155b9d625eb8da79ac0e02ba2ac2414bb1a2ce
SHA256

cfe0886ca00ad1d49210aef97b412f5a6939b8661e8561a9e49644c25889fac9
SHA512

3eac699de8dde159428fbf591a8b945b254128b778b303e5169a4675c58ca40aa2dac1daf6ab7a24e5fb0e0b048a1fdb07c490f672f4dddb86e55d81053078b3
SSDEEP

24576:DEot5VRHSrDvz6IKJQwkQlTZDEz5oUCworH0O6TsKC1sIGvqRfwnp9NAAhzTCXd0:dt5alKvDlTZtjrUO6TsT1svqq9N5hzT5

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vtf	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.vtf\ = "vtf_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\vtf_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2960	AcroRd32.exe
2960	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2796	2112	cmd.exe	31
PID 2112 wrote to memory of 2796	2112	cmd.exe	31
PID 2112 wrote to memory of 2796	2112	cmd.exe	31
PID 2796 wrote to memory of 2960	2796	rundll32.exe	32
PID 2796 wrote to memory of 2960	2796	rundll32.exe	32
PID 2796 wrote to memory of 2960	2796	rundll32.exe	32
PID 2796 wrote to memory of 2960	2796	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\custom\Aperture Tag Gun\materials\models\weapons\v_models\portalgun\goo_nrm.vtf"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\custom\Aperture Tag Gun\materials\models\weapons\v_models\portalgun\goo_nrm.vtf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\custom\Aperture Tag Gun\materials\models\weapons\v_models\portalgun\goo_nrm.vtf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ffc0c8eb2acd499609eb11373f3be7ed

SHA1
0b40701dbbc04582786dd60c2c5d86f31053ee2d

SHA256
eb7b20c01cc5ef85e5fd4646ce2f745d436fd643dcbe70d40537b683e4060a9a

SHA512
0592d6bd5432ce1e9d664d530660e3fb7d188c3c1e16c0eed313bfdc3a5528448ecc6991d2c86d2381fc408e0de8b2f21d0eef74196533ec7fde44b541347fbe

Download Submit