Analysis

  • max time kernel
    3s
  • max time network
    5s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2023 05:33

General

  • Target

    Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe

  • Size

    1.5MB

  • MD5

    f998e3ed9d29a42da397df15518a96b6

  • SHA1

    58bafa0cb613f7e862402aae96e1215fe9e932d2

  • SHA256

    fc247e6789254b76bd8cfb301d0cb0118189cce740a0187835ccc9b94ef7291f

  • SHA512

    19dc735e77c2e375fffd9ca5bde44c1e7b6a19c7cf97ffa62d2e09a6465f515cbfa4c28c6566cf1a165593fadb0600d040c34e800d92f6dd478182beda21bc5c

  • SSDEEP

    24576:BJenhwPDC3wvm01GPp0FBI2eOppTB6DSX/ab+bJ7i7Y7gbaVD:yhmCgvm+YULib+V70YsbaV

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Age of Empires IV v1.0-v17718 Plus 11 Trainer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3864
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3864 -s 1660
      2⤵
      • Program crash
      PID:1304
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 408 -p 3864 -ip 3864
    1⤵
      PID:2264

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\FLiNGTrainer.tmp

      Filesize

      173KB

      MD5

      8e737d35013d6beecd93a0340dc60c06

      SHA1

      404ef01af63a47fca6fa2a8e18180eda249e2f99

      SHA256

      2d267b38cded71d8a42b22fb864a36c0163ac5fc1e69be992a7ced48d259c50e

      SHA512

      feac30b0724627de8c28a1a38702986c372415e0115b40ce524e7b2f7d55fe264464b6e504f75784e3b69a5a4b0ba05071d0e3310fad7f9ac1ec75e0b9d2ec8b

    • memory/3864-135-0x0000021B6E320000-0x0000021B6E350000-memory.dmp

      Filesize

      192KB

    • memory/3864-138-0x0000021B6CA30000-0x0000021B6CA40000-memory.dmp

      Filesize

      64KB

    • memory/3864-139-0x0000021B6CA30000-0x0000021B6CA40000-memory.dmp

      Filesize

      64KB

    • memory/3864-140-0x0000021B6CA30000-0x0000021B6CA40000-memory.dmp

      Filesize

      64KB

    • memory/3864-141-0x0000021B74420000-0x0000021B74428000-memory.dmp

      Filesize

      32KB

    • memory/3864-143-0x0000021B6CA30000-0x0000021B6CA40000-memory.dmp

      Filesize

      64KB