69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lillian Night Succubus Exclusive Contract-v1.2.0/LillianNight_Data/GI/level1/31/3189e8f177434ce566e33cc1ffa515f0.vis
Size

18KB
MD5

c917b15b2bdae33e0dded0848f6d2d4a
SHA1

f54fa7bc7bfdde4f896593bcb69b1c27987d4448
SHA256

e697a5183f7c0d3a52b1c8c60f67a9b8431dda974ea3dc710f7f7d25751d59f7
SHA512

b0001c6644ddef196548cb5cbf0b05dbc4702d135a10270e9ade3b6151a63a64cc2cd2811a73645c8ef963f3d932c549669ce7d08456ac783d29db2e2cb7095d
SSDEEP

384:mw6h8oY9zb9MVfXIUNLPOG0Ij1eJJXx5kuXNOw8Flna2fB:BjogzBEYUNrb0I0JJX0uXNF8fVB

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.vis	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.vis\ = "vis_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\vis_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2656	3068	cmd.exe	31
PID 3068 wrote to memory of 2656	3068	cmd.exe	31
PID 3068 wrote to memory of 2656	3068	cmd.exe	31
PID 2656 wrote to memory of 2592	2656	rundll32.exe	32
PID 2656 wrote to memory of 2592	2656	rundll32.exe	32
PID 2656 wrote to memory of 2592	2656	rundll32.exe	32
PID 2656 wrote to memory of 2592	2656	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\31\3189e8f177434ce566e33cc1ffa515f0.vis"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\31\3189e8f177434ce566e33cc1ffa515f0.vis
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\31\3189e8f177434ce566e33cc1ffa515f0.vis"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fe05c8d95abb55abecbaf5050382b626

SHA1
0ca18d39feddd0a28f5b3bf444e44387387bb20d

SHA256
7840c7c4df8d2e93012964057247a56a75e2a8fd2442f8fbd4ea462b02318070

SHA512
66bbe8953dc2bd19076375a0b509777c1e8df55c1b5d15ce667f6a18f77d6fd68918d4f3c490bbba77948bdec80ea071cbc6ae2b5b5adfa9ef2adececb123b14

Download Submit