b572b5796a4d51d7f132d3a2e44ce55bc29829de76a7640d99ec098b3f8aff25

Resubmissions

02/09/2024, 10:22

240902-mebp5aygke 3

02/09/2024, 10:07

240902-l5mdwayeqg 6

Analysis

max time kernel
49s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Touhou PC98 Collection/GAMES/th04e.bat
Size

102B
MD5

e5d4138f91fb74277dc639a6c9d5f43f
SHA1

9acbad2d0890e967b6b1970d73762a39b6fb8c6e
SHA256

bdf70b79a2c9ac5673322bacaaae504d865d08442b41ea220a45941831a360be
SHA512

1c70ca87b7f74c23ad7f4568e287fc4a0499fef3b0746d3c9269effebcd50bf108daf2beb4d2d2738fa970916668a765e763f6608527abe93378cb25d232bd09

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	np21nt.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2396	np21nt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	np21nt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	np21nt.exe
2396	np21nt.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2396	2280	cmd.exe	30
PID 2280 wrote to memory of 2396	2280	cmd.exe	30
PID 2280 wrote to memory of 2396	2280	cmd.exe	30
PID 2280 wrote to memory of 2396	2280	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\th04e.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.exe
  np21nt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2396

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.ini

Filesize
2KB

MD5
d527abf00daede4d7ba6b5d0dcc88014

SHA1
3634cd7eea21ebab843ef09a5c72531d07f0d912

SHA256
019ee2e3bef120901afb1badc45ba54a0d864967827e1740aa13e8e3b0219274

SHA512
674a69ac02cdf2894fea082e4a56defacfa3078ff1249a07b4c7b250f14d5fe5e5e0d912e63787d36fff7d8bfd7433d12a89870104f9ebcf2ffedd04190a6a88

Download Submit
memory/2396-8-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-7-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-6-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-5-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-4-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-3-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-9-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/2396-10-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-11-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-17-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Filesize
40KB

Download
memory/2396-16-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-15-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-14-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Filesize
40KB

Download
memory/2396-13-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-12-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2396-18-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/2396-19-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

Filesize
40KB

Download