Overview
overview
3Static
static
3Touhou PC9...nt.exe
windows7-x64
3Touhou PC9...nt.exe
windows10-2004-x64
3Touhou PC9...01.bat
windows7-x64
3Touhou PC9...01.bat
windows10-2004-x64
3Touhou PC9...1e.bat
windows7-x64
3Touhou PC9...1e.bat
windows10-2004-x64
3Touhou PC9...1j.bat
windows7-x64
3Touhou PC9...1j.bat
windows10-2004-x64
3Touhou PC9...2e.bat
windows7-x64
3Touhou PC9...2e.bat
windows10-2004-x64
3Touhou PC9...2j.bat
windows7-x64
3Touhou PC9...2j.bat
windows10-2004-x64
3Touhou PC9...3e.bat
windows7-x64
3Touhou PC9...3e.bat
windows10-2004-x64
3Touhou PC9...3j.bat
windows7-x64
3Touhou PC9...3j.bat
windows10-2004-x64
3Touhou PC9...4e.bat
windows7-x64
3Touhou PC9...4e.bat
windows10-2004-x64
3Touhou PC9...4j.bat
windows7-x64
3Touhou PC9...4j.bat
windows10-2004-x64
3Touhou PC9...5e.bat
windows7-x64
3Touhou PC9...5e.bat
windows10-2004-x64
3Touhou PC9...5j.bat
windows7-x64
3Touhou PC9...5j.bat
windows10-2004-x64
3Touhou PC9...er.bat
windows7-x64
1Touhou PC9...er.bat
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Touhou PC98 Collection/GAMES/th02e.bat
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Touhou PC98 Collection/GAMES/th02e.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Touhou PC98 Collection/GAMES/th02j.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Touhou PC98 Collection/GAMES/th02j.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Touhou PC98 Collection/GAMES/th03e.bat
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Touhou PC98 Collection/GAMES/th03e.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Touhou PC98 Collection/GAMES/th03j.bat
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Touhou PC98 Collection/GAMES/th03j.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Touhou PC98 Collection/GAMES/th04e.bat
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Touhou PC98 Collection/GAMES/th04e.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Touhou PC98 Collection/GAMES/th04j.bat
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Touhou PC98 Collection/GAMES/th04j.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Touhou PC98 Collection/GAMES/th05e.bat
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Touhou PC98 Collection/GAMES/th05e.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Touhou PC98 Collection/GAMES/th05j.bat
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Touhou PC98 Collection/GAMES/th05j.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Touhou PC98 Collection/Launcher.bat
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Touhou PC98 Collection/Launcher.bat
Resource
win10v2004-20240802-en
General
-
Target
Touhou PC98 Collection/GAMES/th01.bat
-
Size
101B
-
MD5
ff5b38921a7b73682aa1156a0b9d967a
-
SHA1
4f47623857f8012a8a9852bc9deb152ab1df30e0
-
SHA256
b69413c41e1e9214a73a4643181ceb38b7aa580a50841d1779bd29b0a59d9f27
-
SHA512
01ac68e7765f5927c7043e06b288a52df2a7717dd71a7dd3e72972893e1c457fe96a1e87b8108516a272b81f169f6bb0982708db68cc47a9e4f1013b281e609a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language np21nt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 np21nt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4136 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4136 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2956 np21nt.exe 2956 np21nt.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4348 wrote to memory of 2956 4348 cmd.exe 85 PID 4348 wrote to memory of 2956 4348 cmd.exe 85 PID 4348 wrote to memory of 2956 4348 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\th01.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.exenp21nt.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x31c 0x4a41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5855cea722ed9f18a2ffae4a9abc12c78
SHA179963793b96c8b6e0c2a371e3c9d74e743f6e84e
SHA25679f04d481e8b6739b8a946af6d8e4fac69222ccccd2cb6b535607dfa7339d2d6
SHA5125ee38125ecfe765ca29cc8263bbf89d733716e880b777c59b0e8fda0d71c2cdaf49583955c6ac2cb2b708a9414c4bc648ff92bf447b6f1d79a6a422939df09a9