0d7bc42c56b0f0ee4bbf6e2178db5adbf145295ba4e5dee7532e1c0858ea3fe3

Resubmissions

12/01/2023, 23:39

230112-3njebsbh47 8

12/01/2023, 23:33

230112-3j92gsbh26 8

Analysis

max time kernel
63s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/01/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Counter-Strike.exe
Size

265.2MB
MD5

37667601ee4b53183145118c5751330e
SHA1

f42d970dc4b239ebb34277f96dea5b0a941d6ca9
SHA256

0d7bc42c56b0f0ee4bbf6e2178db5adbf145295ba4e5dee7532e1c0858ea3fe3
SHA512

6c7bd24eac7d5e0474ecb5583f8d66c98b5bad91cd5c2a6b26d06142a5ce0404ab0314f095ccf9751f04db27337a42b21634265364524e55689c92ce46aecf48
SSDEEP

3145728:9fjTxdljCmzc15qJPPZOnJlMKbAhMslm88ayBurKCGk1NxRJg8jKxePjAxxHfOnp:d1D8qJ3EAhHmbFBXk1nXPuAjYeKt79O

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
996	Counter-Strike.tmp

Loads dropped DLL 6 IoCs

pid	Process
1360	Counter-Strike.exe
996	Counter-Strike.tmp
996	Counter-Strike.tmp
996	Counter-Strike.tmp
996	Counter-Strike.tmp
996	Counter-Strike.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	Counter-Strike.tmp
996	Counter-Strike.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	Counter-Strike.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28
PID 1360 wrote to memory of 996	1360	Counter-Strike.exe	28

C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe
"C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp" /SL5="$60120,277524654,60928,C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp

Filesize
700KB

MD5
ccd2afcc8b78a187d60d2fd9e26e2fe1

SHA1
db2c8cff0e12ad35faffa8d181de31eb916e5315

SHA256
4c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671

SHA512
b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9

Download Submit
\Games\Counter-Strike WaRzOnE\CS16Launcher.exe

Filesize
219KB

MD5
002569d719a892cefdee47b40fb9de9d

SHA1
c87baaf1db6f143eafceafb0e10be366a729cff7

SHA256
a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

SHA512
00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

Download Submit
\Games\Counter-Strike WaRzOnE\CS16Launcher.exe

Filesize
219KB

MD5
002569d719a892cefdee47b40fb9de9d

SHA1
c87baaf1db6f143eafceafb0e10be366a729cff7

SHA256
a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

SHA512
00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

Download Submit
\Games\Counter-Strike WaRzOnE\CS16Launcher.exe

Filesize
219KB

MD5
002569d719a892cefdee47b40fb9de9d

SHA1
c87baaf1db6f143eafceafb0e10be366a729cff7

SHA256
a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

SHA512
00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

Download Submit
\Games\Counter-Strike WaRzOnE\hl.exe

Filesize
84KB

MD5
2098ccf443433129b556c2849fe99e26

SHA1
074ddbaff48c88b3b5c8f881c35d2be2bb19a249

SHA256
4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

SHA512
fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

Download Submit
\Games\Counter-Strike WaRzOnE\hlds.exe

Filesize
397KB

MD5
3745840b996a56366857e83cd4244d5f

SHA1
fbdcc19e19aad2dadeb020447344c4c97982bc37

SHA256
e4496e39b112e655b0d2f37489a3bd76c2ec72ba83c4605c3e379619e666d8ad

SHA512
d35ff2980776235896bb00cdfe8d08c236787e36f55100aaebe597f4a7dde9fc5d0999792c2554398c90ad72a2e82c7c276d37f7ff32e1d00cfae703aa6170fe

Download Submit
\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp

Filesize
700KB

MD5
ccd2afcc8b78a187d60d2fd9e26e2fe1

SHA1
db2c8cff0e12ad35faffa8d181de31eb916e5315

SHA256
4c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671

SHA512
b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9

Download Submit
memory/1360-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1360-61-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1360-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download