3ae8545a744e512e12f11a6e32b0dae9fa3e03e025dce4f1ca5b943bff4760a8

Analysis

max time kernel
109s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Need for Speed Most Wanted Trainer Setup.exe
Size

141KB
MD5

eb55b093cf221b1b9b6ae6d5340ea857
SHA1

2a3b43d3bcd24efefcc42d565e9ff1a3d8b8492b
SHA256

3ae8545a744e512e12f11a6e32b0dae9fa3e03e025dce4f1ca5b943bff4760a8
SHA512

36293d2a212af3e22c5f9c643e447ca010c44468842f857e41fecc49013f6409e9a829e54ca586f62b20973c098b1213ce3522735db51d74d9cc1ff0f23f9f13
SSDEEP

3072:Bojm4ILlCI+4COHCyhaEtHZkOpk97oc4ILlCI+4TOHHSafx:Bd+bwaEtHLhiHt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

Need for Speed Most Wanted Trainer Setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35"	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wemod.com	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35"	Need for Speed Most Wanted Trainer Setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Need for Speed Most Wanted Trainer Setup.exe

pid process

3036 Need for Speed Most Wanted Trainer Setup.exe
3036 Need for Speed Most Wanted Trainer Setup.exe

pid	process
3036	Need for Speed Most Wanted Trainer Setup.exe
3036	Need for Speed Most Wanted Trainer Setup.exe

C:\Users\Admin\AppData\Local\Temp\Need for Speed Most Wanted Trainer Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Need for Speed Most Wanted Trainer Setup.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-133-0x000001D7EABB0000-0x000001D7EABD6000-memory.dmp

Filesize
152KB

Download
memory/3036-134-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-138-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-139-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-140-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-141-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-177-0x000001DFF4F80000-0x000001DFF5726000-memory.dmp

Filesize
7.6MB

Download
memory/3036-178-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-179-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-180-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-181-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download
memory/3036-182-0x000001D7EAF60000-0x000001D7EAF70000-memory.dmp

Filesize
64KB

Download