b572b5796a4d51d7f132d3a2e44ce55bc29829de76a7640d99ec098b3f8aff25

Resubmissions

02-09-2024 10:22

240902-mebp5aygke 3

02-09-2024 10:07

240902-l5mdwayeqg 6

Analysis

max time kernel
90s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Touhou PC98 Collection/GAMES/th01j.bat
Size

101B
MD5

ff5b38921a7b73682aa1156a0b9d967a
SHA1

4f47623857f8012a8a9852bc9deb152ab1df30e0
SHA256

b69413c41e1e9214a73a4643181ceb38b7aa580a50841d1779bd29b0a59d9f27
SHA512

01ac68e7765f5927c7043e06b288a52df2a7717dd71a7dd3e72972893e1c457fe96a1e87b8108516a272b81f169f6bb0982708db68cc47a9e4f1013b281e609a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	np21nt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1572	np21nt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2248	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2248	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1572	np21nt.exe
1572	np21nt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1572	3764	cmd.exe	85
PID 3764 wrote to memory of 1572	3764	cmd.exe	85
PID 3764 wrote to memory of 1572	3764	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\th01j.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.exe
  np21nt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\np21nt.ini

Filesize
2KB

MD5
855cea722ed9f18a2ffae4a9abc12c78

SHA1
79963793b96c8b6e0c2a371e3c9d74e743f6e84e

SHA256
79f04d481e8b6739b8a946af6d8e4fac69222ccccd2cb6b535607dfa7339d2d6

SHA512
5ee38125ecfe765ca29cc8263bbf89d733716e880b777c59b0e8fda0d71c2cdaf49583955c6ac2cb2b708a9414c4bc648ff92bf447b6f1d79a6a422939df09a9

Download Submit