Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 21:59
Behavioral task
behavioral1
Sample
b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe
-
Size
414KB
-
MD5
6da763f39780f530ccc0e29bcebc7b81
-
SHA1
86dd169e13dab9cb475bd0dc3a8ab17145b9e3c8
-
SHA256
b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27
-
SHA512
b64420f0b95dc5e7b651a435f92c9b8eccd5761b70ba2f5faba82439bcaf07d44684cbaecf4f406470cce5f0db8215f6112a7459827954271855109bb19f0f3a
-
SSDEEP
1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Hitman II No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior V No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Quake 3 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinRAR 3.11 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Hitman III No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8 Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\IconPackager 2.12 Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\WinZip 8.0 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\IconPackager 2.x Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7004D052-E5E4-49E0-A985-29D8315646D8}.catalogItem svchost.exe File opened for modification C:\Windows\SysWOW64\drivers32\Thief III Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\FireStarter No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2003 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness 3 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.03 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Battlefield 1942 - Secret Weapons of World War II No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\ACDSee 2.4.x Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 5.x Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Metal Gear Solid III Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Winamp 2.91 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior IV No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Flight Simulator - Century of Flight Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness III Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Splinter Cell No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Midtown Madness 3 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Quake III No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\QuickTime 6.x Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life II Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\NCAA Football 2003 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.x Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\mIRC 6.x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Star Trek - Elite Force II No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\NCAA Football 2004 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Train Simulator II No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\NHL 2002 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hitman III Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Midtown Madness 2 Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Thief II Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File created C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne No-Cd Crack.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior V Serial Generator.exe b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1848 1828 b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe 91 PID 1828 wrote to memory of 1848 1828 b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe 91 PID 1828 wrote to memory of 1848 1828 b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe"C:\Users\Admin\AppData\Local\Temp\b121451d206c73608640ef8c84db7204335f54947cff3e89df3c7de7cd3a6a27.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\$$$$$.bat2⤵PID:1848
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD5086753be1cf905080824e8e45c0e2212
SHA16b68981c031206765feba5c898de838253de4b12
SHA256961eb9592099261eede6622bfa13f9b8088dc0b133e593f99e491783fd8065b9
SHA512d3a44ad088584e74d3f4de362514ce1fe132f7a3190068d003bbdeb58588085dd7caa191eeeb953d45133068963b0e4a79ad6e5a205854b7edb98ce2dfc29bb5