Analysis
-
max time kernel
156s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
happygame.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
happygame.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
使用说明.htm
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
使用说明.htm
Resource
win10v2004-20221111-en
General
-
Target
happygame.exe
-
Size
1.4MB
-
MD5
e3d9197418170a4821a3a4f29c40c295
-
SHA1
5ec81300d81477e31150c9f263fa6d136a34c37c
-
SHA256
8d0a52e592a04c76d7f50ec4a51f6eeece7713d5248070b55128444cb84f9b20
-
SHA512
5c0ddba37b7f50a4a7b9c805beceec77431acdd2b8a839018333df8eb663ccda152998adeaa545e6ae592b5ef47b0e3d2dd2bcf05713d44d2b6a87a3bdf07137
-
SSDEEP
24576:kfOy67+f2m2mFGnO7vzd5R5ZZjBMz2UyG3QWx8kJKYvbieHfPmC2EBuSBVjEYAKw:kGp6ffxCu7Z5ZTMMrWKkles3FXBFBVAf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2312 is-40JAU.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main is-40JAU.tmp -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.v2233.com/?444" is-40JAU.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3660 wrote to memory of 2312 3660 happygame.exe 83 PID 3660 wrote to memory of 2312 3660 happygame.exe 83 PID 3660 wrote to memory of 2312 3660 happygame.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\happygame.exe"C:\Users\Admin\AppData\Local\Temp\happygame.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\is-I1CQ8.tmp\is-40JAU.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1CQ8.tmp\is-40JAU.tmp" /SL4 $901C6 "C:\Users\Admin\AppData\Local\Temp\happygame.exe" 1242075 558082⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2312
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD57a084972025ff9b3da070399f221202a
SHA19350b18cd6a0ebdcd74640a731a3801bfd278b1c
SHA25600e7a8e988c85741b3dafb50d0800a528d06de93dcf5520541f0f29a012a5d90
SHA512b551b17fc7f12bc7aed71fa7e410db5373542f0d8ce373d4932b086afa9e6cf561e6af61843f1511557635a4a0b51ca3804a8077be2f5c6981a0eba38bbf32a3
-
Filesize
645KB
MD57a084972025ff9b3da070399f221202a
SHA19350b18cd6a0ebdcd74640a731a3801bfd278b1c
SHA25600e7a8e988c85741b3dafb50d0800a528d06de93dcf5520541f0f29a012a5d90
SHA512b551b17fc7f12bc7aed71fa7e410db5373542f0d8ce373d4932b086afa9e6cf561e6af61843f1511557635a4a0b51ca3804a8077be2f5c6981a0eba38bbf32a3