0af4f05955607f52c6c5eba64c86652ff72992789e5d04e09c285fa6bce427dd

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2023, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Warcraft III.exe
Size

268KB
MD5

a68a3046c54cae35abe39eb6d4a0327a
SHA1

f589a19a85ce7c23e8bd4c4a6d7512b1c18b0297
SHA256

0af4f05955607f52c6c5eba64c86652ff72992789e5d04e09c285fa6bce427dd
SHA512

85973454eceb8cdaacda90b32e47530df6a531f004aebabacdd431dc66d5c0a5b8d66a3b9b27a358dcf51047a5f3059dcfd7c4dca67703285d54829f719c668a
SSDEEP

6144:RY2EhylFdeXGtYrklpMZVWvi3QT3MEQ+ttubNH:nEklKU50ZVugQjv7ttu9

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2386679933-1492765628-3466841596-1000\{10064188-1C0B-4C9B-8E10-D229DD1F6695}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4496	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Warcraft III.exe
"C:\Users\Admin\AppData\Local\Temp\Warcraft III.exe"
1⤵
PID:4968

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...