55253b41ea85c9b9c3e5884d65596994b373ddad306cdaadc0177ba3478a4c65

Analysis

max time kernel
44s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe
Size

94.1MB
MD5

e2dc5b62471275bf7dedd53f0e1a44d0
SHA1

e864f48563d5b218e56cced0f1cfde9e40d899e1
SHA256

31a1736a9405eca8f33609d82aa109f5621e575f97a52a88ce48f189e4d78398
SHA512

89f508d0fb61ddd8aa4d678d8e0fb203a0986e53b9cf6781bd8c447bb675a11a3e6926a104c4040b5405ab6d10d970da41b8ad3ee264c7a6b6eef9e5a8b61fa0
SSDEEP

1572864:jM288G1gqHiFzZx+3WCLO1M7frbOyQAP2hG8U5lFXA5T+wwgTihPmpv:QviFK3WM0AP2h7UxQ5fTiRmpv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5104	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

Loads dropped DLL 1 IoCs

pid	Process
5104	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp
5104	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5104	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 5104	1640	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe	78
PID 1640 wrote to memory of 5104	1640	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe	78
PID 1640 wrote to memory of 5104	1640	Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe	78

C:\Users\Admin\AppData\Local\Temp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe
"C:\Users\Admin\AppData\Local\Temp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\is-DBJ08.tmp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DBJ08.tmp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp" /SL5="$70104,97847258,423936,C:\Users\Admin\AppData\Local\Temp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-DBJ08.tmp\Uncharted 4 Legacy of Thieves Collection update 1.0.20122 - 1.3.20812.tmp

Filesize
1.4MB

MD5
51a965e93d31de32b3e821440acbadc4

SHA1
e230b8fc5f7ce0f8745bfded28c4750f0f6b50a0

SHA256
7cdb2d27946feb5864fbe3f40cfcc6dcb96aa323e08750ca0633ab35598a376a

SHA512
36fd18404756e73e425696bdcecaa6a3c9db3f53a8ba5237dfc243689e6572602ff2c93f843099befd34426fc21d75cad501539e5e96a978913fe331bd1cf55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M0RJI.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1640-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1640-1-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1640-16-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1640-67-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5104-7-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5104-18-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5104-17-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5104-38-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5104-62-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/5104-66-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download