Analysis
-
max time kernel
3s -
max time network
5s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2023 05:33
Behavioral task
behavioral1
Sample
Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
Resource
win10v2004-20230703-en
General
-
Target
Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
-
Size
1.5MB
-
MD5
f998e3ed9d29a42da397df15518a96b6
-
SHA1
58bafa0cb613f7e862402aae96e1215fe9e932d2
-
SHA256
fc247e6789254b76bd8cfb301d0cb0118189cce740a0187835ccc9b94ef7291f
-
SHA512
19dc735e77c2e375fffd9ca5bde44c1e7b6a19c7cf97ffa62d2e09a6465f515cbfa4c28c6566cf1a165593fadb0600d040c34e800d92f6dd478182beda21bc5c
-
SSDEEP
24576:BJenhwPDC3wvm01GPp0FBI2eOppTB6DSX/ab+bJ7i7Y7gbaVD:yhmCgvm+YULib+V70YsbaV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1304 3864 WerFault.exe 79 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3864 Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3864 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3864 -s 16602⤵
- Program crash
PID:1304
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3864 -ip 38641⤵PID:2264
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD58e737d35013d6beecd93a0340dc60c06
SHA1404ef01af63a47fca6fa2a8e18180eda249e2f99
SHA2562d267b38cded71d8a42b22fb864a36c0163ac5fc1e69be992a7ced48d259c50e
SHA512feac30b0724627de8c28a1a38702986c372415e0115b40ce524e7b2f7d55fe264464b6e504f75784e3b69a5a4b0ba05071d0e3310fad7f9ac1ec75e0b9d2ec8b