Overview

overview

6

Static

static

SWZ-2.03/�...d9.dll

windows7-x64

1

SWZ-2.03/�...d9.dll

windows10-2004-x64

3

SWZ-2.03/�...an.dll

windows7-x64

1

SWZ-2.03/�...an.dll

windows10-2004-x64

1

SWZ-2.03/�...er.exe

windows7-x64

6

SWZ-2.03/�...er.exe

windows10-2004-x64

6

SWZ-2.03/�...en.exe

windows7-x64

SWZ-2.03/�...en.exe

windows10-2004-x64

数码资源网.url

windows7-x64

1

数码资源网.url

windows10-2004-x64

1

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SWZ-2.03/【520传奇】守望者加速2.03/GameWatcher.exe

  • Size

    539KB

  • MD5

    acb1c722382b1fab3d8de9465a0e1ad9

  • SHA1

    04eba7da70c7e75fe36ea6e25d1ff30ff965a510

  • SHA256

    6ac229111964eabe293241f73bd006a22263dc21a3e5c814f20a589fb8994b9c

  • SHA512

    8666f505e7e836c4590b259b65bfd21bb6ef5f3790f7960f4d4b60885c8fa7c2b2aff50d0b3110990d106f2300c9b37b4f6e9ce004c162ea720e02a63fe6e7a5

  • SSDEEP

    12288:sY0MfXZT5dPiuNsEgyQzml+bLzuD0XGTs8UeV:sx8ZFtnHWzml/DGqs8x

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SWZ-2.03\【520传奇】守望者加速2.03\GameWatcher.exe
    "C:\Users\Admin\AppData\Local\Temp\SWZ-2.03\【520传奇】守望者加速2.03\GameWatcher.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1168
      2⤵
      • Program crash
      PID:1736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1268
      2⤵
      • Program crash
      PID:4836
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1272
      2⤵
      • Program crash
      PID:4804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1104
      2⤵
      • Program crash
      PID:1724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1028
      2⤵
      • Program crash
      PID:1984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1104
      2⤵
      • Program crash
      PID:4672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1068
      2⤵
      • Program crash
      PID:2260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1204
      2⤵
      • Program crash
      PID:4912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4736 -ip 4736
    1⤵
      PID:3376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4736 -ip 4736
      1⤵
        PID:528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4736 -ip 4736
        1⤵
          PID:4788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4736 -ip 4736
          1⤵
            PID:4692
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4736 -ip 4736
            1⤵
              PID:4348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4736 -ip 4736
              1⤵
                PID:1080
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4736 -ip 4736
                1⤵
                  PID:2248
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4736 -ip 4736
                  1⤵
                    PID:4916

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/4736-132-0x0000000000400000-0x0000000000549000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/4736-133-0x00000000006A9000-0x00000000006AE000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/4736-136-0x00000000006A9000-0x00000000006AE000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/4736-134-0x00000000006A9000-0x00000000006AE000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/4736-135-0x00000000006A9000-0x00000000006AE000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/4736-137-0x0000000000400000-0x0000000000549000-memory.dmp

                    Filesize

                    1.3MB

                    Download