Resubmissions
18-10-2022 07:59
221018-jvd9eafcdq 618-10-2022 07:52
221018-jqp54sfab8 817-10-2022 17:05
221017-vmcamacde2 8Analysis
-
max time kernel
86s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
Meta World Launcher beta.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Meta World Launcher beta.exe
-
Size
712.3MB
-
MD5
3cc7c90b6e6ed6719be20510857e6267
-
SHA1
55634d10827ba52f57d757c6f4c32525cd0386b0
-
SHA256
7a2f2553d96eb5b9b56169dc1ae83500b23d821529e627c54e867d21973cbc4b
-
SHA512
fe07a83d3885e2f0dad27334b035ab3f5596c61364a5282a893084ea9b334e353c1b8e8ee8fe0825fa050b0570842eae1f334e9bfd6061e4efa079f6d2f9b4d7
-
SSDEEP
196608:wYfg0UGi9r7wQ6sRgGQAEctmM5xrdShPO:RZUGCUQ6lkm0rSh
Score
6/10
Malware Config
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 Meta World Launcher beta.exe 2960 Meta World Launcher beta.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 700 Taskmgr.exe 700 Taskmgr.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 700 Taskmgr.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 700 Taskmgr.exe 700 Taskmgr.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 4100 AppLaunch.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4100 AppLaunch.exe Token: SeDebugPrivilege 700 Taskmgr.exe Token: SeSystemProfilePrivilege 700 Taskmgr.exe Token: SeCreateGlobalPrivilege 700 Taskmgr.exe Token: 33 700 Taskmgr.exe Token: SeIncBasePriorityPrivilege 700 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe 700 Taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 2960 wrote to memory of 4100 2960 Meta World Launcher beta.exe 82 PID 216 wrote to memory of 700 216 launchtm.exe 88 PID 216 wrote to memory of 700 216 launchtm.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Meta World Launcher beta.exe"C:\Users\Admin\AppData\Local\Temp\Meta World Launcher beta.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:700
-