110ed2f09d165b3a7ebb28eaf7d1217069e352c82b6dde598ca6a70befb98d1e

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StardewXnbHack-develop/StardewXnbHack/Framework/UnpackContext.cs
Size

631B
MD5

f0ac025b382233db1a47961bf6bd8fb6
SHA1

123df1176ef07bd1f31ff44a86d1efc3699ce4b8
SHA256

cb2bd5116ab869a38f61c33106bfe6ee9bd3ec60f0ceb6ad2f8b179edd64b6f8
SHA512

7ec1646ecca17611d1c84defa2c47ad985f02ef568f1cebd1426e03c79d0295d1efdf7941b70f27350ba054102a9afcca21d84b2ae668cad37a9f0c305ae5440

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 2692	488	cmd.exe	30
PID 488 wrote to memory of 2692	488	cmd.exe	30
PID 488 wrote to memory of 2692	488	cmd.exe	30
PID 488 wrote to memory of 2692	488	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\StardewXnbHack\Framework\UnpackContext.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:488
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\StardewXnbHack\Framework\UnpackContext.cs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4fa334b5178f2a429dbeaae0359a2721

SHA1
3bc024d037613e0bbd8d6b10fd28f83795b4c0f2

SHA256
3fe8c31015b59afb2e1f26062f1910bea2599c1d56cca171c2f51392e388977d

SHA512
79d28a178fb0ee976f20aef3eb1cd32349c8483676f3589fddc1072b629155e3a429ef7b5fdf19cbfea6b94d3cd510944f6c3020d52c71743e1557e3fe4251f0

Download Submit