9b5b6d43994986218f138e5d9cfd824ebeb594f44cbdf6733cc63d0933bddc08

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
植物大战僵尸杂交版v2.6.1/【三选一】DX加速补丁/dgVoodoo.conf
Size 20KB
Sample241109-e4dl1sxjbx
SHA256 c7e210cce096a6401e4e0aef13f50b9aa0786a10cb5e6bceeaf569fb56b0d99f
MD5 049a1666841e144b0ae4173dc1616384
SHA1 3990dac81a4e7afdb09c68718a7222a86d9edbe4
SHA512 7d9f779e03836e5210f1bc2f8d8b324d318272eb9422d13ea072aa787f08098cd6d46adcc3e003d1a5a0153c89ce31e853c05dca8f36c432e73732903724fa31
SSDEEP 384:0CHUgo/Uc/IUN6EFEfKv3HjFNG3GpjJgozAtjg8zgKZeZo:j7WIUN6vfKv3HjFI2xChzkm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	AcroRd32.exe
2868	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2564	1972	cmd.exe	31
PID 1972 wrote to memory of 2564	1972	cmd.exe	31
PID 1972 wrote to memory of 2564	1972	cmd.exe	31
PID 2564 wrote to memory of 2868	2564	rundll32.exe	32
PID 2564 wrote to memory of 2868	2564	rundll32.exe	32
PID 2564 wrote to memory of 2868	2564	rundll32.exe	32
PID 2564 wrote to memory of 2868	2564	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\植物大战僵尸杂交版v2.6.1\【三选一】DX加速补丁\dgVoodoo.conf
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\植物大战僵尸杂交版v2.6.1\【三选一】DX加速补丁\dgVoodoo.conf
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\植物大战僵尸杂交版v2.6.1\【三选一】DX加速补丁\dgVoodoo.conf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 5c99ad967783d75889ffb588bb3f2bd1a3ab05b0212841d5c65f2f6ca0787b64
MD5 de6cd888e44b3e1cbe68ea9d6dbb787c
SHA1 05c7d30b16c1301b02df07845380e63c8a7a2a57
SHA512 45b2ed1bdef117c3af956a82f5efa8bd3e325081b8511e2797078358ed23b1c48a25ba340f98ad940515324b3f13279e633823e30461a88505b468a5429fe4fe
MD5 SHA1 SHA512

Submit Download