Overview
overview
8Static
static
8GameHardware.exe
windows7_x64
8GameHardware.exe
windows10-2004_x64
8IP地址修改器.exe
windows7_x64
3IP地址修改器.exe
windows10-2004_x64
3VMwarehardware.exe
windows7_x64
8VMwarehardware.exe
windows10-2004_x64
8hardware.exe
windows7_x64
8hardware.exe
windows10-2004_x64
8一键修....exe
windows7_x64
7一键修....exe
windows10-2004_x64
7分区序....exe
windows7_x64
1分区序....exe
windows10-2004_x64
1网卡MAC....exe
windows7_x64
1网卡MAC....exe
windows10-2004_x64
1Analysis
-
max time kernel
89s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:56
Static task
static1
Behavioral task
behavioral1
Sample
GameHardware.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
GameHardware.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
IP地址修改器.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
IP地址修改器.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
VMwarehardware.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
VMwarehardware.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
hardware.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
hardware.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
一键修改系统信息.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
一键修改系统信息.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
分区序列号修改工具.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
分区序列号修改工具.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
网卡MAC地址修改工具.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
网卡MAC地址修改工具.exe
Resource
win10v2004-20220414-en
General
-
Target
GameHardware.exe
-
Size
3.0MB
-
MD5
2f9c82f0f68238e9119e58522a7edbdd
-
SHA1
de538ef85d65ae879bb54f0c359320c04d3f1c1b
-
SHA256
48268e44f32fbb789e29a02aa6dde585b9b9139f37a9a06be2140edb145a7118
-
SHA512
1e2584082b47a7bc07ad93906ea43cf9c497676373ef90d68a7357be4ace38f66db453d647baba48bec6d88211ef22ce685cefad96b1eb5423a95de320c08444
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1944-55-0x0000000000810000-0x0000000000E1E000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
GameHardware.exepid process 1944 GameHardware.exe 1944 GameHardware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
GameHardware.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\virtualhardwares.com\NumberOfSubdomains = "1" GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total GameHardware.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.virtualhardwares.com\ = "63" GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\virtualhardwares.com GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.virtualhardwares.com GameHardware.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\virtualhardwares.com\Total = "63" GameHardware.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" GameHardware.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage GameHardware.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" GameHardware.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GameHardware.exedescription pid process Token: SeDebugPrivilege 1944 GameHardware.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
GameHardware.exepid process 1944 GameHardware.exe 1944 GameHardware.exe