Analysis

  • max time kernel
    102s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25-08-2024 00:04

General

  • Target

    SCPH-70004_BIOS_V12_PAL_200.rom2

  • Size

    512KB

  • MD5

    82dc50fa18e636850f557c4ea66c7bfd

  • SHA1

    cc44355ded232a2ba5309bb24d4cd55af08696b2

  • SHA256

    b86fbccaa111ca7497630337dafea7da7320fc4f924ada22b92145ef806e7b42

  • SHA512

    ec1dc6cf74dfc34f01fbbcc2e0f11bb32d7a52101f8ebbd4ca10268165fe2639efa98e018f0a6ae58f74a491461ab301b9dbf9213687731cc2fb4dcb1e22317b

  • SSDEEP

    6144:DBFsXCSZ3B4YEXxyCpmDqoPYmMsHw1SiXWIXjxqJ4Li:1Sf3ounMsMjq4O

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.rom2
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.rom2
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.rom2"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    664647657035afd79e13ca97e08829aa

    SHA1

    68cca795b721f7dfb07098c3ebd2ec1b12740e9d

    SHA256

    4196d8a18f7b406525c6010aa7770cd1133cf765ad4ece6d09653d4b6f65db78

    SHA512

    4c1fc536e65d211a9531a987c93b70544a903b931d4c8b3ac98ee1892d6c02fc133e3a7da707c44fd3148b9ad4cb2aabffa59d911b48dfa80a69309d1c07f8fc

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.