b572b5796a4d51d7f132d3a2e44ce55bc29829de76a7640d99ec098b3f8aff25

Resubmissions

02-09-2024 10:22

240902-mebp5aygke 3

02-09-2024 10:07

240902-l5mdwayeqg 6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Touhou PC98 Collection/GAMES/th01e.bat
Size

102B
MD5

4d638e63c73f8c590079ede556e71292
SHA1

4be3cb67f15c6d4e888dc73195ce5f7b5b5bcf60
SHA256

bef43b6efb4f77b47390f761c29c03fa0339255b34493a739992b45091d9534a
SHA512

f6207a3912a8f18bb65fc5416245bc89e16683ef54b236b443ea90bba1a2c158d021eed047db0d7d109b4d3ddb80e0d6f13df72ab8b91675667f7a91382d8e22

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	np21nt.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2528	np21nt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	np21nt.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	np21nt.exe
2528	np21nt.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2528	2088	cmd.exe	31
PID 2088 wrote to memory of 2528	2088	cmd.exe	31
PID 2088 wrote to memory of 2528	2088	cmd.exe	31
PID 2088 wrote to memory of 2528	2088	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\th01e.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.exe
  np21nt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.ini

Filesize
2KB

MD5
01715e46ea65729c03ff4251ca2d1a80

SHA1
d87d113151793a50fa9c8b421a7ef10ea23024e5

SHA256
41b3df8900c5ddcdeb16a14deb4400800df95a08ad1d4112c94dc18c9ecfacf5

SHA512
3c58858d57468ce6a594c572f2a53782715824834a1566cd0972638cb1ac1ff13602a3c74af099d5eb547c9188b0e68424869802fc2c842197e94ebdf28e33a0

Download Submit
memory/2528-8-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-7-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-6-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-5-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-4-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-3-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-11-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-10-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-9-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-15-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-14-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-13-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-12-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-17-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-16-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-19-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-18-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-21-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-22-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-20-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/2528-23-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-25-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-24-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/2528-26-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-27-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/2528-28-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download