Overview
overview
5Static
static
3Oblivity.rar
windows7-x64
3Oblivity.rar
windows10-2004-x64
3Oblivity/d...nifest
windows7-x64
3Oblivity/d...nifest
windows10-2004-x64
3Oblivity/s...90.acf
windows7-x64
3Oblivity/s...90.acf
windows10-2004-x64
3Oblivity/s...ly.dll
windows7-x64
1Oblivity/s...ly.dll
windows10-2004-x64
1Oblivity/s...ty.exe
windows7-x64
1Oblivity/s...ty.exe
windows10-2004-x64
5Oblivity/s...d1.caw
windows7-x64
3Oblivity/s...d1.caw
windows10-2004-x64
3Oblivity/s...d1.ecm
windows7-x64
3Oblivity/s...d1.ecm
windows10-2004-x64
3Oblivity/s...ws.sse
windows7-x64
3Oblivity/s...ws.sse
windows10-2004-x64
3Oblivity/s...d1.rgb
windows7-x64
3Oblivity/s...d1.rgb
windows10-2004-x64
3Oblivity/s...sc.sse
windows7-x64
3Oblivity/s...sc.sse
windows10-2004-x64
3Oblivity/s...d1.vis
windows7-x64
3Oblivity/s...d1.vis
windows10-2004-x64
3Oblivity/s...0a.caw
windows7-x64
3Oblivity/s...0a.caw
windows10-2004-x64
3Oblivity/s...0a.ecm
windows7-x64
3Oblivity/s...0a.ecm
windows10-2004-x64
3Oblivity/s...ws.sse
windows7-x64
3Oblivity/s...ws.sse
windows10-2004-x64
3Oblivity/s...0a.rgb
windows7-x64
3Oblivity/s...0a.rgb
windows10-2004-x64
3Oblivity/s...sc.sse
windows7-x64
3Oblivity/s...sc.sse
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 18:12
Static task
static1
Behavioral task
behavioral1
Sample
Oblivity.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Oblivity.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Oblivity/depotcache/1389991_7145957302409288600.manifest
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Oblivity/depotcache/1389991_7145957302409288600.manifest
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Oblivity/steamapps/appmanifest_1389990.acf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Oblivity/steamapps/appmanifest_1389990.acf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Oblivity/steamapps/common/Oblivity/GameAssembly.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Oblivity/steamapps/common/Oblivity/GameAssembly.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Oblivity/steamapps/common/Oblivity/Oblivity.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
Oblivity/steamapps/common/Oblivity/Oblivity.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.caw
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.caw
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.ecm
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.ecm
Resource
win10v2004-20240910-en
Behavioral task
behavioral15
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.iws.sse
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.iws.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rgb
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rgb
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rsc.sse
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rsc.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.vis
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.vis
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.caw
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.caw
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.ecm
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.ecm
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.iws.sse
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.iws.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rgb
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rgb
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rsc.sse
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rsc.sse
Resource
win10v2004-20240802-en
General
-
Target
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rgb
-
Size
720KB
-
MD5
ba3932b3ce02fdb723d87ce2315b87be
-
SHA1
e1d21fe26b6db0135b8d6f8636bcebe4b5b4384c
-
SHA256
a74489252a8fb3dd59ad07a5ea03fe89e5bc4ebf89ea2ed5fd4d61e7b79f5ce9
-
SHA512
c0525c263f16284ee49ffd29c8ced84bf1e88506af7c5595de1709e37cdfc86cf0a5db9351ea1f2896df7bdb8b0112973906ca700e1f90f2f732ce6ab63ce689
-
SSDEEP
48:eAnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnUnnnnnnnnnnx:C
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.rgb\ = "rgb_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\rgb_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.rgb rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 AcroRd32.exe 2748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2744 2124 cmd.exe 31 PID 2124 wrote to memory of 2744 2124 cmd.exe 31 PID 2124 wrote to memory of 2744 2124 cmd.exe 31 PID 2744 wrote to memory of 2748 2744 rundll32.exe 32 PID 2744 wrote to memory of 2748 2744 rundll32.exe 32 PID 2744 wrote to memory of 2748 2744 rundll32.exe 32 PID 2744 wrote to memory of 2748 2744 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Oblivity\steamapps\common\Oblivity\Oblivity_Data\GI\level4\d0\d06ee7eda6916184a427fef9cc7ee30a.rgb1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity\steamapps\common\Oblivity\Oblivity_Data\GI\level4\d0\d06ee7eda6916184a427fef9cc7ee30a.rgb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Oblivity\steamapps\common\Oblivity\Oblivity_Data\GI\level4\d0\d06ee7eda6916184a427fef9cc7ee30a.rgb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57684881f74f1c25e6a9797c86f363b64
SHA1d6e67b6828642dc086e4bf5251e873d96ee0db9a
SHA256d096e96a992a87ee1be3a4d18d85854832f40052f99d39071ebe22e59a99cfef
SHA512b2f81c2551baf20dc6eef6ad90a658ab91c0ced60ad6a24f33242ca19488775becf29dc1c84df4d32c80780b04d2157a9944cdffa2bbb140cd1bc82f6d24dd18