b572b5796a4d51d7f132d3a2e44ce55bc29829de76a7640d99ec098b3f8aff25

Resubmissions

02/09/2024, 10:22

240902-mebp5aygke 3

02/09/2024, 10:07

240902-l5mdwayeqg 6

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Touhou PC98 Collection/GAMES/th02j.bat
Size

102B
MD5

0f556ce7d489973269d4ce5eeaac094f
SHA1

6e23dba43648f21e132f159dd2f828feda324fa2
SHA256

3543960c24cca823c71b92f61c0d2e5bb93b306a62f8c8f56ac21c3eab34fca2
SHA512

0502a239e7060129a565915d4585a1e703932f672e51f26435f0c17e5ae6d446142c789dd77899ac3cc34ed904411d5b97175df91465f9d33fd8095195df01c5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	np21nt.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2860	np21nt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	np21nt.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	np21nt.exe
2860	np21nt.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2860	2672	cmd.exe	31
PID 2672 wrote to memory of 2860	2672	cmd.exe	31
PID 2672 wrote to memory of 2860	2672	cmd.exe	31
PID 2672 wrote to memory of 2860	2672	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\th02j.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.exe
  np21nt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.ini

Filesize
2KB

MD5
cd23ab470e55ac7f8ba171fa72c06967

SHA1
5e05ac0b6498d1825f67617e9585a90d308a2ea5

SHA256
59236f1ef5cb6582e19e722a2116f65f9b1f2d6759ddb0479a9362c02da6ea58

SHA512
0a58a3d3eed50dc39e7d9d728647fdc991cc6339707f7b8cb588999ff07fcb59a73d59ef099c9a51fd30df5e03997d6fe0758d8ff7bbe34fb46efc6a3e5b35ee

Download Submit