0a0811dda75710e4be5f57710ba378b24edf8a413254e891a5acf2958c125fa0

Resubmissions

12/08/2024, 01:29

240812-bwmyyayfmk 6

12/08/2024, 01:28

240812-bvrwhayfjp 6

Analysis

max time kernel
102s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DualSenseY.deps.json
Size

14KB
MD5

22aa00fd793b9c7aa3f95452ecc99921
SHA1

bb83d6fa4a7e675456e901ea2fa1390bfb17ff48
SHA256

2ccbf57c7538c562fe48f32d563b9072754d3f92b3f889eed23ffa4b3af54ce8
SHA512

d374f36c4730c18ef02d1ba7811e6d7efb31b5dbcd126dd8db97c3d33ad7267a453ac019678513d6b5e830f5703b804843468938919e4dca337545e7c277a0b2
SSDEEP

192:CWf80/lVvPFGDmD8lD8j+E8ev3Ry3GlVZl6W2Zfrzdv8BzI8d6zjEr:CWf1HKmDoDghz9lB6FZXdAIXz4r

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2936	2000	cmd.exe	31
PID 2000 wrote to memory of 2936	2000	cmd.exe	31
PID 2000 wrote to memory of 2936	2000	cmd.exe	31
PID 2936 wrote to memory of 2908	2936	rundll32.exe	32
PID 2936 wrote to memory of 2908	2936	rundll32.exe	32
PID 2936 wrote to memory of 2908	2936	rundll32.exe	32
PID 2936 wrote to memory of 2908	2936	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DualSenseY.deps.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DualSenseY.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DualSenseY.deps.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a351be5d055f14127bd8a5ca124f728

SHA1
153a12bfc644df4d3802d963eebb56bc3911bc94

SHA256
f6c98b858f2e5c14c20300c72d597372300f2caf76562a8f200ae80c8e649c84

SHA512
0d9f771aa7c262d322ae5887ef3053123c368aa7ab38971eb08583cfa07d4a8779d7e93e1c14ac0d3279c4f6431fcab6c9b95de1550afd7a00cf7aa9cc3eb4af

Download Submit