9a4f371dafc70b6347dc125ec9803df96b2d77511e42bc1c236fbaf1c56be1ef

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OverwatchWebcam Win64 v.0.4-97/OverwatchWebcam_Data/StreamingAssets/aa/StandaloneWindows64/_unitybui.bundle
Size

37KB
MD5

87a31e963824f487771312cde939623b
SHA1

baf56dab9e8fda1ed6e6f70c7e54d4970a36b3c8
SHA256

9d4eafc1c11f3808bb114818640b3cadbb7986556e035261a7ec34e1c3e605c6
SHA512

1207d48a11967bfd51b35afb87713840367df32241525bf832873f91c5ffbbd3cc13f3d5214a4ab5cefcdefb43f9e0886398d19cb1dc22544c6dfbe9c8104fd6
SSDEEP

768:bZm5KbbwXoR1Dt78rWm9QTUrU9u17YFr7KrbACX+lRMYTrQBOIsDcm:b7cw1tcWm2TTu1uOrn+lWYghsDcm

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2288	2228	cmd.exe	32
PID 2228 wrote to memory of 2288	2228	cmd.exe	32
PID 2228 wrote to memory of 2288	2228	cmd.exe	32
PID 2288 wrote to memory of 2840	2288	rundll32.exe	33
PID 2288 wrote to memory of 2840	2288	rundll32.exe	33
PID 2288 wrote to memory of 2840	2288	rundll32.exe	33
PID 2288 wrote to memory of 2840	2288	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\_unitybui.bundle"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\_unitybui.bundle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\_unitybui.bundle"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b03920d8b57dc8428047f8594932e7c

SHA1
1bde2e542b9822a48a4b3c32687635840d4151f7

SHA256
afd22a9e3c27b5e7f697d6d46a0d58ef031350e90cdc99a42344f4e65f685c3e

SHA512
195811c31eea813f35e9d919e80e75a9bb00e2cefdb89cb0af42e8ee147ecb601d863a31649721d5883300ba64f0a8e6fe39602bafefed30fedfd6cb420146f4

Download Submit