5bd1981e9a8b2c17a40c5db9a7af9e3cbbd8893bc08ea678dec0daf55efb2d59

Resubmissions

06-01-2025 13:52

250106-q6fd6sxrfx 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dennis RDR2 Online Cheat V2.rar/Language/de_DE.json
Size

119KB
MD5

b475fa31d2dec434d81077cd0b50ed0f
SHA1

3c76adeb7145e50f91f0dd42278ffe67aa4a9531
SHA256

446b3f803948ce411c1a8b7fbbe06275247cbb780be6db9f1c94488fccf52aeb
SHA512

acdd0b320c8bb10a32b75cdd778de58e72f66441057e9585b6a73badb5403cf46223d5c30bc88105d8b63ff340ea3e89f6c4b9d06f63cc950b3e559c3f4f61d0
SSDEEP

1536:TG+M/On6HmjNbrVa1GVJ0kG3IH7ytWc0xaMXrKZSDJmcBUwi8A:UlCB+Wc0xaW+IJmoUwi8A

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2400	1992	cmd.exe	32
PID 1992 wrote to memory of 2400	1992	cmd.exe	32
PID 1992 wrote to memory of 2400	1992	cmd.exe	32
PID 2400 wrote to memory of 2852	2400	rundll32.exe	33
PID 2400 wrote to memory of 2852	2400	rundll32.exe	33
PID 2400 wrote to memory of 2852	2400	rundll32.exe	33
PID 2400 wrote to memory of 2852	2400	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dennis RDR2 Online Cheat V2.rar\Language\de_DE.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dennis RDR2 Online Cheat V2.rar\Language\de_DE.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dennis RDR2 Online Cheat V2.rar\Language\de_DE.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c81504898520575528d6c9cd54196bf

SHA1
e5950535c0116a375c79a7228ae825dfa644afec

SHA256
f6411119f9ea6bcb8a12888e0798706347aba371e22effef191b0858ce6f2a60

SHA512
df40d964631dd0b0ca7ab8b9e7b75324b60470ec9719e82f290aa03b745cb392593c2aefc09202e10349459cbaa2ad6786e1c9af94eb042617dad112ed6810c7

Download Submit