Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2023 12:30

General

  • Target

    Monster Hunter World v20200109-v20231017 Plus 67 Trainer.exe

  • Size

    1.6MB

  • MD5

    c0f2c2ee45be74ca6cda10201cd84502

  • SHA1

    92357cf088a14908b7734763f74cd1089fba9f57

  • SHA256

    9d35edf837b20069101d555fa9dd60f61cef790614e7f33ab5ac1edf87655545

  • SHA512

    52a9c4d4829a5173f981622067cf3e32525a81b38937da1e286b3aafbf8809ec81667aa0a75dec0e2fdd0d2668c0be34e3073dfe4bd5275d8e3c9071b14d4dbf

  • SSDEEP

    24576:r0yOdKnqj9MNrOoThmBZTsl3WaPECkDtGQjnEd7DSVXT5X1hn:gSqj9MxOt83J/kwonPXT5X1h

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20231017 Plus 67 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20231017 Plus 67 Trainer.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    41cb256c51b972144374bdfd15c2e52c

    SHA1

    e56ce07c9ec85522bcdf07ed62825ad0deeee2b2

    SHA256

    5032ab3320cdc2800ef7ca42007a73c3baf10ca7b8b9d18339ede0d2bf8ac6b3

    SHA512

    f991114076c34e9213b0978d55588e2bbef8451060ca4ecfd2cc9202b4c1edc941bd4c8ecc6b6ce87498ce16941276e2be7a3d733d0d640410d9e624316559c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    a9ee4da55a76509ddf17f531bb1853e6

    SHA1

    8e1b6f2f8b467135af2ed53ff55bc4906f1b09f3

    SHA256

    74037ac9c59a921da277e3a9d94ffe1e83eef4912c69c084b77fed1871fe6785

    SHA512

    b3a07796c5256393ebf85e880dd4e48c93af629d57a6fa0b3a617d5c407852fb5f08718b04db302c520225999c7cb76bad81aa6b4a2e4a4a07500719dc4f4089

  • C:\Users\Admin\AppData\Local\Temp\Tar13D4.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2920-6-0x000000001B160000-0x000000001B1E0000-memory.dmp

    Filesize

    512KB

  • memory/2920-3-0x000000001B160000-0x000000001B1E0000-memory.dmp

    Filesize

    512KB

  • memory/2920-10-0x000000001B160000-0x000000001B1E0000-memory.dmp

    Filesize

    512KB

  • memory/2920-2-0x000000001B160000-0x000000001B1E0000-memory.dmp

    Filesize

    512KB

  • memory/2920-4-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB

  • memory/2920-5-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB

  • memory/2920-1-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

    Filesize

    9.9MB

  • memory/2920-0-0x0000000001CB0000-0x0000000001CE4000-memory.dmp

    Filesize

    208KB

  • memory/2920-132-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

    Filesize

    9.9MB

  • memory/2920-133-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB

  • memory/2920-134-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB