Overview
overview
6Static
static
Princess.Conquest.rar
windows7-x64
3Princess.Conquest.rar
windows10-2004-x64
3Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...rr.ps1
windows7-x64
1Princess.C...rr.ps1
windows10-2004-x64
1Princess.C...rm.dll
windows7-x64
1Princess.C...rm.dll
windows10-2004-x64
1Princess.C...19.ttf
windows7-x64
1Princess.C...19.ttf
windows10-2004-x64
1Princess.C...ld.otf
windows7-x64
1Princess.C...ld.otf
windows10-2004-x64
1Princess.C...NS.ttf
windows7-x64
1Princess.C...NS.ttf
windows10-2004-x64
1Princess.C...TG.ttf
windows7-x64
1Princess.C...TG.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ngelog
windows7-x64
1Princess.C...ngelog
windows10-2004-x64
1Princess.C...ICENSE
windows7-x64
1Princess.C...ICENSE
windows10-2004-x64
1Princess.C...NSE.en
windows7-x64
1Princess.C...NSE.en
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Analysis
-
max time kernel
130s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-12-2022 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Princess.Conquest.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Princess.Conquest.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win10v2004-20220812-en
General
-
Target
Princess.Conquest/PCGAMESTORRENTS.COM.url
-
Size
202B
-
MD5
420715a04de8367bb8d37d57ce1d6d41
-
SHA1
710369a636391e43be7149416d8e9b390863babb
-
SHA256
c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
-
SHA512
8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f454f3a41ad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16020ED1-8698-11ED-B2BF-6651945CA213} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3df8b3a950e5b4c99ea2f6d24feb26c00000000020000000000106600000001000020000000eb44e2b8cff73a57fcfc6301379deace0a13bf59a9cb9dfcc248b13589609eff000000000e80000000020000200000007c9ce15a396926f358dd97ec0170b9eb24157cfa2294b78e9632d6787fc4f0469000000078ab7d8e84ff6182867c9517158f2e99001d702290be42c23f5367cf924d98664348700236926e45225bc87be94ca14d6e5e4c606c959ccb507aa80bac169bd54499406c1bc9416ced0a5206e396f8c9db56f30aa9d4297f7dd5f16fb56a42ee5a33bb198b84498c26e6e018f2c53ed44147665ff786e40da4418fd9aa174b3267f18dc71c17ad4205a65977aa8ea26440000000b1b6a7a5c38a7097f17d33197066a1e5bad05e8e17b00407d9fdd9b58a2c76373b3a1cfab38b2fe7ac1bd4f22557bfd74f0d51e649302fea812e451a779dfa11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378987303" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3df8b3a950e5b4c99ea2f6d24feb26c00000000020000000000106600000001000020000000657697cbc352316b3dc65750223072656b591f1e0f143e2bd02adb0e134807a8000000000e8000000002000020000000f001e0f1b92742d30271597b02ddd599290bb6072afad894d0d6ec9f383050be20000000a95f258d25fae3e85ea83095e8ba5fb57a99460e0205aad510b2a1c695de7057400000000f97f013371744aba7965fa5748b776227d82fbe0fa36440e45ea0a52a9096865c2ec8abca2501ee8a24c9faf0e8e6fab68a61d84fd01d9de8146f797ba6b09b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\Princess.Conquest\PCGAMESTORRENTS.COM.url:favicon IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 616 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 616 iexplore.exe 616 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 2012 616 iexplore.exe 29 PID 616 wrote to memory of 2012 616 iexplore.exe 29 PID 616 wrote to memory of 2012 616 iexplore.exe 29 PID 616 wrote to memory of 2012 616 iexplore.exe 29
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Princess.Conquest\PCGAMESTORRENTS.COM.url1⤵
- Checks whether UAC is enabled
PID:1524
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5041c2a3e9305a3ff800aae231d327501
SHA19c736a4540752cf1cb4c31bf32634ceaedae0c34
SHA25670593c128cea0ebdfb360d7f102d6b7f31cec439ebff3eba89fa89451ac633c4
SHA512857575af01cc34ca187d6a581c8f6c14ad5fead43f475489cea4e1f5117f76043ed38e2eec9889214db9d00ba02c74b047fa8c70d11325033cfdf6a47df088c3
-
Filesize
5KB
MD50f02eb0f42fb3d309da1b434ffac50c4
SHA12367181fc2815dd2152544d5d4946f8f29390524
SHA25627f3d881badeeac94f29b1ee770ac051901932ea49913ebcc47b80b4fd6fef43
SHA512c50e4ef171dac8c67149c9d4dd2738a944c2b19f03d253ceb2714d11755e9e136d29ac9a4fb82615476a7bdbba867c21857b73f42c3daf8f17e9365cf8887d58
-
Filesize
592B
MD54892eca3ac5c2cd8f89c30e194605e2d
SHA1022c34c938ca1400ab02b28b0c3750b9545d61e1
SHA256821ca511e49d1e4212f27eeef8e39d1a68e34d877225760019af3b33d01804cc
SHA51283eaf7f699768fd9a2b510fc205124658d1e2706fd03d16ea13314d02e226fa064b3d26ea3419c7d7ae379a06ec61fb52c72efa4ed715d651811428fa914ad3e