69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d

Analysis

max time kernel
110s
max time network
66s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lillian Night Succubus Exclusive Contract-v1.2.0/LillianNight_Data/GI/level1/6b/6b561e693a8216de1af4cd3bd3710084.rpc.sse
Size

20KB
MD5

8bb06acc62e0eab21ef75aef3c4ae763
SHA1

29e6496fb99f95d1727ca07cae4505c556384755
SHA256

9b8f25a7257a5b6c24936b5d3906d265f54eeb6c2e638c8ee1062bc68427f78b
SHA512

feab6e633255623420e67f73ae1a49b4e244808db96545e9668dc22100ce0fea346bb8ff74ba12758a4ffb206f3c9a7fdb7c3e6f3e7cc87e2187a47824f80cc3
SSDEEP

384:O6QohSAknNOhfdn9XZ5ogaxinY3FdkL5AsvsvFYUo9ALu6:O9KSAkcRdn9XZ51nMGLyskvFYb4

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.sse\ = "sse_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.sse	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\sse_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2752	2720	cmd.exe	30
PID 2720 wrote to memory of 2752	2720	cmd.exe	30
PID 2720 wrote to memory of 2752	2720	cmd.exe	30
PID 2752 wrote to memory of 2608	2752	rundll32.exe	31
PID 2752 wrote to memory of 2608	2752	rundll32.exe	31
PID 2752 wrote to memory of 2608	2752	rundll32.exe	31
PID 2752 wrote to memory of 2608	2752	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\6b\6b561e693a8216de1af4cd3bd3710084.rpc.sse"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\6b\6b561e693a8216de1af4cd3bd3710084.rpc.sse
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\6b\6b561e693a8216de1af4cd3bd3710084.rpc.sse"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2361384a3e57e1112e89fa8c18455578

SHA1
c7d5f69fb3df4171dc76f8e2f36295fa89c58330

SHA256
69bf095ad752fa3ce04fc5ec72c5cd0a78dcb747b16778969aad1806cf497342

SHA512
59c392cd8f5691132f2deeb6aaa40ec0824aa94b0e3b770aa8333128ec84fecf8b2f71f2446e648cfb116bc607b4f84310c960ebf4d013852180a4a01b0e8651

Download Submit