Analysis
-
max time kernel
137s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 12:59
Static task
static1
Behavioral task
behavioral1
Sample
Forza Horizon 3 Trainer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Forza Horizon 3 Trainer.exe
Resource
win10v2004-20230220-en
General
-
Target
Forza Horizon 3 Trainer.exe
-
Size
4.1MB
-
MD5
a6f52d140f5966169c610f9a9544ae84
-
SHA1
a0dde95ee0d9a9458c15af6a03ba278931cf9c1c
-
SHA256
743fe39d0211f8ff96134b23aac887376c98e49da6a92d6d829758502d5e5509
-
SHA512
edc346bdcb18c0f47f9bf2bc7b0e6413d0f6fdc354a1962dad5a44dde172f9ecccf7c2d3988a96a982f791c8372468fe2d957a31f7012390968bbdf27c954bf1
-
SSDEEP
98304:SwR5DHp/k14EdE0Bbjsf5W4qDzq6RlNkwc3u/B:ZDG100c55gqwlquJ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Forza Horizon 3 Trainer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Forza Horizon 3 Trainer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Forza Horizon 3 Trainer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Forza Horizon 3 Trainer.exedescription ioc process File opened for modification \??\PhysicalDrive0 Forza Horizon 3 Trainer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Forza Horizon 3 Trainer.exepid process 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe 1248 Forza Horizon 3 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Forza Horizon 3 Trainer.exedescription pid process Token: SeDebugPrivilege 1248 Forza Horizon 3 Trainer.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-134-0x0000000000A90000-0x0000000001322000-memory.dmpFilesize
8.6MB
-
memory/1248-135-0x0000000000A90000-0x0000000001322000-memory.dmpFilesize
8.6MB
-
memory/1248-136-0x0000000000A90000-0x0000000001322000-memory.dmpFilesize
8.6MB
-
memory/1248-137-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-138-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-139-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-140-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-141-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-143-0x0000000000A90000-0x0000000001322000-memory.dmpFilesize
8.6MB
-
memory/1248-144-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-145-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-146-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB
-
memory/1248-147-0x000000001D3D0000-0x000000001D3E0000-memory.dmpFilesize
64KB