3ef8bb1d645223deb465bfdb08638db1fe1a804911a47f0d7f3863e412e87627

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DsE-0.6.0-pc/game/005.rpa
Size

1.4MB
MD5

f7d2c5efb610f70905fbeaa28078b504
SHA1

735ebfa3aac0fe08949afcff064e412c8a117d58
SHA256

44e1d463fd29d5cc59f8e4f5b785a5dd0484fb6251c333f3f1e5dc2c9b1aa89f
SHA512

0b57d69a28bb1ff4f1781729ebbc1531547f28426358d4c52a13b0c5babac8bd9c56544da8ab3e4227aa8d89cb0b816a82e299a6aa8bbfb2ed54487a92d16805
SSDEEP

12288:4vv4Wvr4NZeYWyoKiRv9dCC7uXvhugWXvb//vPUMhYvoXDomv8HdV9eAb9vxzKRL:I46IoKioXS/fXRX6su+L2HGe9CHLmG/

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.rpa\ = "rpa_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.rpa	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\rpa_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1244	1384	cmd.exe	32
PID 1384 wrote to memory of 1244	1384	cmd.exe	32
PID 1384 wrote to memory of 1244	1384	cmd.exe	32
PID 1244 wrote to memory of 2576	1244	rundll32.exe	33
PID 1244 wrote to memory of 2576	1244	rundll32.exe	33
PID 1244 wrote to memory of 2576	1244	rundll32.exe	33
PID 1244 wrote to memory of 2576	1244	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DsE-0.6.0-pc\game\005.rpa
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DsE-0.6.0-pc\game\005.rpa
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DsE-0.6.0-pc\game\005.rpa"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
52ace865ec6d382dcd3f981d374ed94b

SHA1
e1677c426115a7e4c7368311855b5095627a6847

SHA256
0ec6a0bcd385fbf766be22a0758261c3e99feac2929c3a6361e3a187d064cf96

SHA512
b72f092e9937d4467e5689a0d8eeb5c94dc1bc996671e6f3fdf8ec361b32412ef36a9e6901159c996f0bdbd99c0dae7d64d06b33998805aa670c62dabb3384d0

Download Submit