Resubmissions

30-09-2024 02:57

240930-dflr2svapl 3

30-09-2024 02:54

240930-dedp2sydrf 3

30-09-2024 02:49

240930-dbcnksycnh 3

30-09-2024 02:46

240930-c9pkcsybqb 3

Analysis

  • max time kernel
    92s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-09-2024 02:46

General

  • Target

    Balatro.v1.0.1c.Beta/Balatro/steam_settings/depots.txt

  • Size

    16B

  • MD5

    6b4da729626a2d8da4daafe86700d246

  • SHA1

    3f9093fc81ea782c6c4c5e45819cff1c33aa0042

  • SHA256

    320fb08d23e2d79ab12d69a95ac6802abe4ecef44f9802ab3fbc442addc7dd93

  • SHA512

    bc6ca6f27f068ba9b31d8af20c7231d440112b6a195240af45cd6d6df892c01ed832406d0d3c1e8e8649f4a03d06519cd09947d4666031a8c01eb1bbdeeca794

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.1c.Beta\Balatro\steam_settings\depots.txt
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.1c.Beta\Balatro\steam_settings\depots.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads