Resubmissions

25/08/2024, 10:12

240825-l8vvesyeke 3

25/08/2024, 10:07

240825-l5r95aycpa 3

Analysis

  • max time kernel
    601s
  • max time network
    644s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 10:07

General

  • Target

    The Henry Stickmin Collection/HenryStickmin.exe

  • Size

    96KB

  • MD5

    2e5b99f2a72ecd9bf5abd2a9ac7395fa

  • SHA1

    2dae5c691b0c9e9f22b052fb09984870d44824a2

  • SHA256

    61e4cfd5dc011109dddc75391ad5ef5a97edaeba86d3f81b35df2ca6723a85c7

  • SHA512

    07f80706c3f7ffe233cdb12c6bb4a4d08b91e508bdd46a8f9e251b33f0a5a288abd95ccd5d9f44f434cfd637090dfcea6acd833d99f8971d2ef18bb85edec5f7

  • SSDEEP

    1536:fynfkRc7VR7s8Vk7rf9MjNqgKI15Fo+QfssWncdf70MSKEkL28:fcR7HVcrFONqdOvS3f7fSKEkL7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\HenryStickmin.exe
    "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\HenryStickmin.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of SetWindowsHookEx
    PID:1164
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4d0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1164-0-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/1164-258-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-261-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-260-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-259-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-257-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-256-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-293-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/1164-296-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-298-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-297-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-299-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-300-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB

  • memory/1164-301-0x0000000003F60000-0x0000000003F6A000-memory.dmp

    Filesize

    40KB