Analysis
- max time kernel
60s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
31/03/2023, 13:12
General
- Target The Last of Us Part I v1.0 Plus 15 Trainer.exe
- Size 1.6MB
- Sample230331-qfnmvsba6v
- SHA256 4fdbb63d8959e889635aaea6ca77244e25087714d23fd15dec043a412f2bce5c
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\The Last of Us Part I v1.0 Plus 15 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\The Last of Us Part I v1.0 Plus 15 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
TrainerSettings.ini
memory/1932-140-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-151-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-135-0x00000180ADB90000-0x00000180ADBC4000-memory.dmp
memory/1932-141-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-142-0x00000180CBA80000-0x00000180CBA88000-memory.dmp
memory/1932-143-0x00000180CBB00000-0x00000180CBB38000-memory.dmp
memory/1932-144-0x00000180CBAD0000-0x00000180CBADE000-memory.dmp
memory/1932-139-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-138-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-154-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-155-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-156-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-157-0x00000180C6660000-0x00000180C6670000-memory.dmp
memory/1932-158-0x00000180C6660000-0x00000180C6670000-memory.dmp