110ed2f09d165b3a7ebb28eaf7d1217069e352c82b6dde598ca6a70befb98d1e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StardewXnbHack-develop/StardewXnbHack/Framework/Writers/DataWriter.cs
Size

1KB
MD5

24f2026661b84889e9b32ffc6e42a016
SHA1

4a4cd98226f08640abd5a7e67a2484f4829655c5
SHA256

6a6c0757dd6dee1c465c0e670d53bc97e66c947fb4e8157856361014ab9b8a2d
SHA512

8c6c13cbd88d60a5efd710e42d03e4fdb3b29e736372568fcf6c174e669ed3e6c4f23f36c2e5b51c677bfa977a53f817a66d368b3a4283d28558a22ef2a3bb04

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2884	2084	cmd.exe	32
PID 2084 wrote to memory of 2884	2084	cmd.exe	32
PID 2084 wrote to memory of 2884	2084	cmd.exe	32
PID 2084 wrote to memory of 2884	2084	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\StardewXnbHack\Framework\Writers\DataWriter.cs
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\StardewXnbHack\Framework\Writers\DataWriter.cs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6308be5e9f1afa02fdf8e4234b532ed5

SHA1
e6f2d81387dd58527387f09444aedf10a4af4e0e

SHA256
874c131f4100e42e3d5a0af5e0860f681978353c017a29af834cbfee53f8c421

SHA512
4cac49f4faee41c54d261ac292307a8af6eb13f91239d18a223fac713e91fdc90e108ce5019b05826dd23aa125175fa743f77b162200180b8225da77a910987e

Download Submit