Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2023 12:59
Static task
static1
Behavioral task
behavioral1
Sample
Forza Horizon 3 Trainer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Forza Horizon 3 Trainer.exe
Resource
win10v2004-20230220-en
General
-
Target
Forza Horizon 3 Trainer.exe
-
Size
4.1MB
-
MD5
a6f52d140f5966169c610f9a9544ae84
-
SHA1
a0dde95ee0d9a9458c15af6a03ba278931cf9c1c
-
SHA256
743fe39d0211f8ff96134b23aac887376c98e49da6a92d6d829758502d5e5509
-
SHA512
edc346bdcb18c0f47f9bf2bc7b0e6413d0f6fdc354a1962dad5a44dde172f9ecccf7c2d3988a96a982f791c8372468fe2d957a31f7012390968bbdf27c954bf1
-
SSDEEP
98304:SwR5DHp/k14EdE0Bbjsf5W4qDzq6RlNkwc3u/B:ZDG100c55gqwlquJ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Forza Horizon 3 Trainer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Forza Horizon 3 Trainer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Forza Horizon 3 Trainer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Forza Horizon 3 Trainer.exedescription ioc process File opened for modification \??\PhysicalDrive0 Forza Horizon 3 Trainer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Forza Horizon 3 Trainer.exepid process 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe 2024 Forza Horizon 3 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Forza Horizon 3 Trainer.exedescription pid process Token: SeDebugPrivilege 2024 Forza Horizon 3 Trainer.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-55-0x0000000000870000-0x0000000001102000-memory.dmpFilesize
8.6MB
-
memory/2024-56-0x0000000000870000-0x0000000001102000-memory.dmpFilesize
8.6MB
-
memory/2024-57-0x000000001DD20000-0x000000001E020000-memory.dmpFilesize
3.0MB
-
memory/2024-58-0x000000001D8C0000-0x000000001D940000-memory.dmpFilesize
512KB
-
memory/2024-59-0x000000001D8C0000-0x000000001D940000-memory.dmpFilesize
512KB
-
memory/2024-60-0x000000001D8C0000-0x000000001D940000-memory.dmpFilesize
512KB
-
memory/2024-62-0x0000000000870000-0x0000000001102000-memory.dmpFilesize
8.6MB
-
memory/2024-63-0x000000001D8C0000-0x000000001D940000-memory.dmpFilesize
512KB
-
memory/2024-65-0x000000001D8C0000-0x000000001D940000-memory.dmpFilesize
512KB