Overview
overview
6Static
static
3Stockfish-...32.exe
windows7-x64
3Stockfish-...32.exe
windows7-x64
1Stockfish-...om.url
windows7-x64
6Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-...sample
windows7-x64
3Stockfish-.../tt.js
windows7-x64
3Stockfish-...ted.sh
windows7-x64
3Stockfish-...rft.sh
windows7-x64
3Stockfish-...rch.sh
windows7-x64
3Stockfish-...ure.sh
windows7-x64
3Analysis
-
max time kernel
1559s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-08-2024 19:40
Static task
static1
Behavioral task
behavioral1
Sample
Stockfish-15.1_Windows_32bit/Stockfish-15.1_general-32.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Stockfish-15.1_Windows_32bit/Stockfish-15.1_x86-32.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
Stockfish-15.1_Windows_32bit/chessengeria.com.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/applypatch-msg.sample
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/commit-msg.sample
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/fsmonitor-watchman.sample
Resource
win7-20240729-en
Behavioral task
behavioral7
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/post-update.sample
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-applypatch.sample
Resource
win7-20240729-en
Behavioral task
behavioral9
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-commit.sample
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-merge-commit.sample
Resource
win7-20240704-en
Behavioral task
behavioral11
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-push.sample
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-rebase.sample
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/pre-receive.sample
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/prepare-commit-msg.sample
Resource
win7-20240729-en
Behavioral task
behavioral15
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/push-to-checkout.sample
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
Stockfish-15.1_Windows_32bit/source/.git/hooks/update.sample
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
Stockfish-15.1_Windows_32bit/source/src/tt.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Stockfish-15.1_Windows_32bit/source/tests/instrumented.sh
Resource
win7-20240704-en
Behavioral task
behavioral19
Sample
Stockfish-15.1_Windows_32bit/source/tests/perft.sh
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Stockfish-15.1_Windows_32bit/source/tests/reprosearch.sh
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
Stockfish-15.1_Windows_32bit/source/tests/signature.sh
Resource
win7-20240708-en
General
-
Target
Stockfish-15.1_Windows_32bit/source/.git/hooks/applypatch-msg.sample
-
Size
478B
-
MD5
ce562e08d8098926a3862fc6e7905199
-
SHA1
4de88eb95a5e93fd27e78b5fb3b5231a8d8917dd
-
SHA256
0223497a0b8b033aa58a3a521b8629869386cf7ab0e2f101963d328aa62193f7
-
SHA512
536cce804d84e25813993efdd240537b52d00ce9cdcecf1982f85096d56a521290104c825c00b370b2752201952a9616a3f4e28c5d27a5b4e4842101a2ff9bee
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.sample rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.sample\ = "sample_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\sample_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2816 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2816 AcroRd32.exe 2816 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1976 wrote to memory of 2924 1976 cmd.exe rundll32.exe PID 1976 wrote to memory of 2924 1976 cmd.exe rundll32.exe PID 1976 wrote to memory of 2924 1976 cmd.exe rundll32.exe PID 2924 wrote to memory of 2816 2924 rundll32.exe AcroRd32.exe PID 2924 wrote to memory of 2816 2924 rundll32.exe AcroRd32.exe PID 2924 wrote to memory of 2816 2924 rundll32.exe AcroRd32.exe PID 2924 wrote to memory of 2816 2924 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stockfish-15.1_Windows_32bit\source\.git\hooks\applypatch-msg.sample1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stockfish-15.1_Windows_32bit\source\.git\hooks\applypatch-msg.sample2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stockfish-15.1_Windows_32bit\source\.git\hooks\applypatch-msg.sample"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD57b48731a4a1a4d601d67ccbf7c4cbc3f
SHA110f09b7cf4c8a3dd337c600287111f9f660b655e
SHA25628cd6ad57fee81e45f7b1d55f24d2309451e131f042eee710fcb9f1d47841663
SHA5128bdc5bcff48921742e790978cb7333ecd02dc5e6d07313348aeead7a8d865f14ee191ef07fbfd236ef5f59a000c0f63a1da115b08f25486f2151bf3b942e1f4b