0af4f05955607f52c6c5eba64c86652ff72992789e5d04e09c285fa6bce427dd

Analysis

max time kernel
60s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/02/2023, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Warcraft III.exe
Size

268KB
MD5

a68a3046c54cae35abe39eb6d4a0327a
SHA1

f589a19a85ce7c23e8bd4c4a6d7512b1c18b0297
SHA256

0af4f05955607f52c6c5eba64c86652ff72992789e5d04e09c285fa6bce427dd
SHA512

85973454eceb8cdaacda90b32e47530df6a531f004aebabacdd431dc66d5c0a5b8d66a3b9b27a358dcf51047a5f3059dcfd7c4dca67703285d54829f719c668a
SSDEEP

6144:RY2EhylFdeXGtYrklpMZVWvi3QT3MEQ+ttubNH:nEklKU50ZVugQjv7ttu9

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{921EF53F-16D4-423A-A074-A173148E3F16}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Warcraft III.exe
"C:\Users\Admin\AppData\Local\Temp\Warcraft III.exe"
1⤵
PID:3444

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads