69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lillian Night Succubus Exclusive Contract-v1.2.0/LillianNight_Data/GI/level1/22/22131084f3072603c13218a186a9e0ed.rgb
Size

1KB
MD5

327b3321e2eec607195842901c603c30
SHA1

1a095c1d3ad75008485bf937594823b5ccb95845
SHA256

b95e066f74d48e0712358b411d919c87ccf2fe2384309577a977cfa538d17fb4
SHA512

dc35c32120c44273f907f99f7b7cf263735c637491627c7f9bf05bbf65a72bac24a143cd568d52eb292f7c974da3a5cbe16138a4ef83cb31a8b4f9fa9aed4fd1

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.rgb\ = "rgb_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\rgb_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.rgb	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 276	2304	cmd.exe	32
PID 2304 wrote to memory of 276	2304	cmd.exe	32
PID 2304 wrote to memory of 276	2304	cmd.exe	32
PID 276 wrote to memory of 2752	276	rundll32.exe	33
PID 276 wrote to memory of 2752	276	rundll32.exe	33
PID 276 wrote to memory of 2752	276	rundll32.exe	33
PID 276 wrote to memory of 2752	276	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\22\22131084f3072603c13218a186a9e0ed.rgb"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\22\22131084f3072603c13218a186a9e0ed.rgb
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\22\22131084f3072603c13218a186a9e0ed.rgb"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4ee7ff383a91a3851ac1063e5d8c806e

SHA1
fc535de5f7366f8644e942692c7d12702aeb6478

SHA256
50c16e326fdcca6a2113b26f660594574a4854afa6c4904ffad85efd55de5ba5

SHA512
37ec3eff1381a68ac9a1bbcea447bc3efda170f7d666c48160c26c069d2477396226fa5bb3671a5b035e843911b055c0b1cb242713992e6d31340a56c5277e51

Download Submit