f139ed18bca38e4e61fa88f94f0a070d217df1c1f647191510253352724ea1b5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OblivionCheatVIP 2.1/Addons/Zlib/6.5/login.json
Size

23B
MD5

1f27b170426a8afbab13c8fb9f0fda4d
SHA1

d4a1ee28812feec9f26de2696f58574f63bd71d6
SHA256

fc4d31fe0e2f82e79f8a257d579552dc6bde6f2477ec81f208debcec4aae40fd
SHA512

a46f917eef10bcb4695eac885ff4367a5e63536ac14cf4a59f91447e88b9830d2d351c05293516f0a2c937d118774128da09db045ac99788c6f4ee3211a60f44

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2376	808	cmd.exe	31
PID 808 wrote to memory of 2376	808	cmd.exe	31
PID 808 wrote to memory of 2376	808	cmd.exe	31
PID 2376 wrote to memory of 2772	2376	rundll32.exe	33
PID 2376 wrote to memory of 2772	2376	rundll32.exe	33
PID 2376 wrote to memory of 2772	2376	rundll32.exe	33
PID 2376 wrote to memory of 2772	2376	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\Addons\Zlib\6.5\login.json"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\Addons\Zlib\6.5\login.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\Addons\Zlib\6.5\login.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
359c164a1c7a24e4609ec816c65cd9e2

SHA1
90e409f18c0bc20f55c38a0d33973a1a545d7205

SHA256
a042b99cba8bfb8152e432440c4b398051d62f0b196cc56e714249fb05e9a5b5

SHA512
e1d69894e3609f7aef5a2ffafa79f02a16c9a43f5189c3516ab9c1d151329410b97b75136ce0e849c7cc4a3cf93325644d5aed9b3f26233ae0325aed684eeb12

Download Submit