9a4f371dafc70b6347dc125ec9803df96b2d77511e42bc1c236fbaf1c56be1ef

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OverwatchWebcam Win64 v.0.4-97/OverwatchWebcam_Data/StreamingAssets/aa/StandaloneWindows64/actionsce.bundle
Size

2.2MB
MD5

1ca62a30d1dddea72d24ac266e4cd314
SHA1

06a4f015d00976bd5fd594032d53ef918c605cfc
SHA256

01ed2bd7f8c56febacc9bb756a4e2ca357c04169c814a9f6d674bb4ee1f86287
SHA512

8c54ba6a0259325bfaa6bb6321f35aca099aa8614fcbb32e1f7c72aefa2d27784d594e0dd2e6ae49365d72b16c8b222b5203a2070e913e139ff5c9755cdf9b7c
SSDEEP

49152:SFZhBD4+PyLl/k1QIOv9tJDOkZthZQJiccE03:SjjDlk9dIOVtJikhZmcp3

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2672 wrote to memory of 2840	2672	cmd.exe	32
PID 2840 wrote to memory of 2588	2840	rundll32.exe	33
PID 2840 wrote to memory of 2588	2840	rundll32.exe	33
PID 2840 wrote to memory of 2588	2840	rundll32.exe	33
PID 2840 wrote to memory of 2588	2840	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\actionsce.bundle"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\actionsce.bundle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OverwatchWebcam Win64 v.0.4-97\OverwatchWebcam_Data\StreamingAssets\aa\StandaloneWindows64\actionsce.bundle"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
84af68d662de2b67ce60ab1215a693bc

SHA1
b7e8282442d1a222f957176e80a111269b1f8416

SHA256
230429a85b3dd171d09c8f3798f3e0fb00a4d13717cb34a669d06dfcaa7beefc

SHA512
775aad8b8955d1a95154c08f636acca2c5105aace4772a245796723fe03953a492cc0a03f17d579a9e42b1e9881e37f152ba07c49d8fe63869de38dcec9a6c2a

Download Submit