Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe
-
Size
1.5MB
-
MD5
3910ef983b69104abeba5ec291728ac2
-
SHA1
cfc1dcb01c813f09cb9f5250faef413c4cd7183b
-
SHA256
b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d
-
SHA512
e3768efe9445b94cef426e715c951cc55401f1f1504b220b9bacbdf33e788179ea10c37758861a5bc96dee8187bbedc31be6281048f2327d7f68541f6c6b6842
-
SSDEEP
24576:DIEA/gk7ypzK7RlBO4cCuTdnF5CsNX6uOdIhBfBAAElYO/knVnVqOY4b74:DIEXVKlfOfFYsNX6zApXEVkVwOY4n4
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 40 IoCs
description ioc Process File created C:\Program Files (x86)\hahagame\Skins\简约之美.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\金属之美.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\828la.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\828la.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\bb.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\chs.dll b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\冬季恋歌.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\flash.mdb b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\兰色沉思.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\冬季恋歌.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\count.htm b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\__tmp_rar_sfx_access_check_240567359 b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\金色年华.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\金属之美.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\chs.dll b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\flash.mdb b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\Office2003.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\兰色沉思.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\金色年华.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\chis.ini b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\ClientUpdate.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\Office2007.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\GameClient.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\蔚蓝天际.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\chis.ini b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\简约之美.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\蔚蓝天际.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\bb.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\ClientUpdate.exe b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File opened for modification C:\Program Files (x86)\hahagame\count.htm b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\Office2003.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe File created C:\Program Files (x86)\hahagame\Skins\Office2007.asz b3fd4de7929f3c7f258fa0da21e188f646d75266a779e528db7b6e04716fe71d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.