Overview

overview

7

Static

static

3

PhasmoMenu...]_.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/08/2024, 20:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe

  • Size

    7.2MB

  • MD5

    547707b98636f7f46477517c148b348e

  • SHA1

    f77289e3a8d7193e70aff99678e3fd5aac5b2d59

  • SHA256

    f6136577076a86a427e5738152af5bc62ce6b32d1b43092a9259b45971ee1281

  • SHA512

    67f8cc59815e69fa420c85169bf4aaed2337ba1877aac3ae7d606b8ad78a59bbc901a86917ec4ce015f4511edf0bf4ef1618ca3ccc4f5ef970b4a6a673a0d732

  • SSDEEP

    196608:phOajefl9HwWgRfVvxwGfpJBIqgESfVkUcL/r3rftb6:phjeflpwVRflxwGfpHyfqL/r3bA

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 44 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe
    "C:\Users\Admin\AppData\Local\Temp\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe
        "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\CET_Archive.dat
          Filesize

          6.9MB

          MD5

          a305a1f8b0e087101d172e395ff9c9de

          SHA1

          b6e2b610ac465ed46940f1c41280459b3fbd3a68

          SHA256

          de1d738ef20e9da62addc3b72dfff3cddf36c1d45a4066660d9a734b308b636d

          SHA512

          215a302bd3c5f96cbed1cce5df5f6cfc9426a47f99878c4598b812741dde07a17576d848aa71758a95ca7383e0e0d831d06c489d2f00ea583016bdc9485cf502

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe
          Filesize

          225KB

          MD5

          971b37cedf686e0ac8ca0297a953aad9

          SHA1

          8ea777fa6c70a619d4e92cc6435c4eba2b16a23e

          SHA256

          1965546a19990b4523a1588eb0d7fdd42bd443e2bcc632dae04343d358394ae7

          SHA512

          2f0f3facf2587b751bb658eaab9ca1536d7326956b0eeca7bd0badc893c0878741f8bb56d8c1e360f2cb4bd9442866bd9faf7bdec7d02105f6c149640cf180d8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\CET_TRAINER.CETRAINER
          Filesize

          158KB

          MD5

          4fc9002e0df427f662e55533598bf6fc

          SHA1

          3d91cff9a4e5f9bf3c3ed615d9a6bf71450fd826

          SHA256

          9edca8cecc59a23993a4561932cd851936682f4894f81737fac74c951d850461

          SHA512

          c1495ffce4d5592adcc52fd62850ef3a5e4f52506bff4e28a4dc676a0093a4c4e8b71e982721ca2ddabe8ff0e32b8633770151a4f6e2e90adaff7cc4dee762c7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\PhasmoMenu v0.5.3.4 By PappyG_[unknowncheats.me]_.exe
          Filesize

          15.9MB

          MD5

          edeef697cbf212b5ecfcd9c1d9a8803d

          SHA1

          e90585899ae4b4385a6d0bf43c516c122e7883e2

          SHA256

          ac9bcc7813c0063bdcd36d8e4e79a59b22f6e95c2d74c65a4249c7d5319ae3f6

          SHA512

          1aaa8fc2f9fafecbe88abf07fbc97dc03a7c68cc1d870513e921bf3caeaa97128583293bf5078a69aecbb93bf1e531605b36bd756984db8d703784627d1877d1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\autorun\luasymbols.lua
          Filesize

          629B

          MD5

          df4d243ab0407a1f03ccf448232fcf62

          SHA1

          62453cfa7abf6fa83158be1ba86c854d9a6b7d4b

          SHA256

          c5a35380af8bebe96b85377f5f41f8c068cb857c74b9cb85b7467b35c1de10c4

          SHA512

          4b05b65909673e92f59ab64c1ff4e0b829f5c9085eafa1fff28cb0ccd7e6a7f6ef031633f443e0ba156a4b8f5009f526d0356f39ef77b22706f98f100b1909c2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\autorun\monoscript.lua
          Filesize

          132KB

          MD5

          76168ca68f3ed8ade110b140244efbaf

          SHA1

          2af08403d17a64b10429c8fce68aa085a6b287b7

          SHA256

          5832b5ab00e84690ac1e780e8b1c4abd9649465234c9ffa2cecb410be66a6b8a

          SHA512

          80ad21d631934d2b8e368a5b2d3cb5f1889d4a65099c2d8cd8ba37eb721c1ebdc2c6549fc530514bf9f96976ffcbfd372150f1f16a6591da013fe4f1d1bb070b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\defines.lua
          Filesize

          12KB

          MD5

          62e1fa241d417668f7c5da6e4009a5a6

          SHA1

          f887409e3c204a87731f317a999dc7e4cc8d3fcd

          SHA256

          82e8ef7df20a86791cef062f2dcacb1d91b4adc9f5dea2fd274886be8365b2f8

          SHA512

          2283cbb9e1d5d53ad1ed9bc9db6034fb3c53c633b11001f373523640bbbba95da9a3a0866c7d5fa0620facab7d18c8577dfd69496fc7319e0a4a74d0b9e10c45

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET636D.tmp\extracted\lua53-64.dll
          Filesize

          528KB

          MD5

          b7c9f1e7e640f1a034be84af86970d45

          SHA1

          f795dc3d781b9578a96c92658b9f95806fc9bdde

          SHA256

          6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff

          SHA512

          da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3

          Download Submit