ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e

Analysis

max time kernel
91s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
Size

131KB
MD5

a340db5c1ccaeef167670f7b971c4280
SHA1

db8d446c8b11db917b84ec6985608021448dae21
SHA256

ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e
SHA512

d9495124afd3fb0ff2f56c551ecf4992ab1d47fe1b94cf44e8e97658e3deef736e6dfccd7f03496b829016a4f06e4bd55b2c28eab2e80289a4b0429ec4a96a76
SSDEEP

3072:lV2BZVPlFlnxClFvLLcs+sPDzGvxyjquGm3zWQBmRDRkRHFN:bQrNFxwj9+UGvxuQmDWQODRkJ

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\UT2004_hack.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4(trainer).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Quake3_nocd.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Quake3 hack.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Silent Hill 4(trainer).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Quake3_nocd.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Counter-Strike(codes).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Counter-Strike(cdfix).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\DAoC(codes).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\DAoC(codes).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Doom 3_codes.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Sims 2_crack.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Half-Life 2(serial).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2(serial).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\UT2004_hack.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File created	C:\Windows\win32dc\Doom 3_codes.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike(cdfix).exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
File opened for modification	C:\Windows\win32dc\Quake3 hack.exe	ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	2400	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe
"C:\Users\Admin\AppData\Local\Temp\ceb905f96c3fa44a8abef8407afcb0575b3d77a1e59e5450a496b5eeb02b662e.exe"
1⤵
- Drops file in Windows directory
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 468
  2⤵
  - Program crash
  PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2400 -ip 2400
1⤵
PID:620

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads