Analysis

  • max time kernel
    24s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    06-07-2023 05:33

General

  • Target

    Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe

  • Size

    1.5MB

  • MD5

    f998e3ed9d29a42da397df15518a96b6

  • SHA1

    58bafa0cb613f7e862402aae96e1215fe9e932d2

  • SHA256

    fc247e6789254b76bd8cfb301d0cb0118189cce740a0187835ccc9b94ef7291f

  • SHA512

    19dc735e77c2e375fffd9ca5bde44c1e7b6a19c7cf97ffa62d2e09a6465f515cbfa4c28c6566cf1a165593fadb0600d040c34e800d92f6dd478182beda21bc5c

  • SSDEEP

    24576:BJenhwPDC3wvm01GPp0FBI2eOppTB6DSX/ab+bJ7i7Y7gbaVD:yhmCgvm+YULib+V70YsbaV

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1152

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c47162c94fd6cad46d13c62f048da9d6

    SHA1

    4de92a27ffd8d57ce6f93a91a603e6c168d9c789

    SHA256

    7c34090057bb59eb467c53248895359015d7442f0723dcc3d9f7612b9ce467ff

    SHA512

    67a989c0bb4a0ea664b5c6af0c1b7ae721739cc039302726531a01eba6a1452922f306e75d80e056745daab4851388e6831a12b9cbecf04be77a13ab5370a01e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a5428d96ac3848180fe084103813311

    SHA1

    8f211ad280561640275b29360802e4be39e78387

    SHA256

    68438bad05294ea8cc4e5f3840df9c5c32d3cfdd3030b98accbfb28ebfa170e5

    SHA512

    d584e4ecf117339df15c1eb46f53c33937daba806704aec866bde2ee534b93a27e804161bbe214f51df2bcab182b9819b405134a1733b4047e149fd675b602dc

  • C:\Users\Admin\AppData\Local\Temp\Cab4C01.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar4CFE.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/1152-56-0x0000000001CC0000-0x0000000001CF0000-memory.dmp

    Filesize

    192KB

  • memory/1152-59-0x000000001B090000-0x000000001B110000-memory.dmp

    Filesize

    512KB

  • memory/1152-60-0x000000001B090000-0x000000001B110000-memory.dmp

    Filesize

    512KB

  • memory/1152-62-0x000000001B090000-0x000000001B110000-memory.dmp

    Filesize

    512KB

  • memory/1152-61-0x0000000001BA0000-0x0000000001BAA000-memory.dmp

    Filesize

    40KB

  • memory/1152-173-0x000000001B090000-0x000000001B110000-memory.dmp

    Filesize

    512KB