Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e32c1a11141625b0134c415053ad5bb.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e32c1a11141625b0134c415053ad5bb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
1e32c1a11141625b0134c415053ad5bb.exe
-
Size
1.2MB
-
MD5
1e32c1a11141625b0134c415053ad5bb
-
SHA1
2b33b656402702bd5f461c0d4a7874187d944a74
-
SHA256
7be14cd0a5b46b713bf62910a6e6fba911b8cda336b11188a62f65bb2918ee6f
-
SHA512
160157b426f42b2efdf7a6e772d2d60e3e806ad8f6a1b0832ece6c8c4711b2741805ec3c38a2ad9214572df79ce0f1c3b29c0fe2c4066d01b0c8c5a40c924f62
-
SSDEEP
3072:s+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:JZmqt6Qyiy3b6CR10TY8JOArF9S9
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" 1e32c1a11141625b0134c415053ad5bb.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Xenus Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior IV Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinZip 9.x Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Lords of EverQuest Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior V No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Armor2net Personal Firewall 3.1 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Midtown Madness 3 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Quake 3 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinZip 9.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Black & White 2 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Half-Life 2 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life 2 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Warcraft III Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\NCAA Football 2004 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\SimCity 4 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\SolSuite 2003 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\SimCity 4 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\GeoWhere 2.11 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\GeoWhere 2.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Nero Burning ROM 6.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior V Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Microangelo 5.x Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\DAP Plus 5.3 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\WinZip 9.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Battlefield 1942 - The Road to Rome Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\F1 2002 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Armor2net Personal Firewall 3.1 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Microangelo 5.58 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Soul Reaver 3 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Medal of Honor - Allied Assault Breakthrough No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Star Wars Jedi Knight - Jedi Academy Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Silent Hill 3 No-Cd Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File created C:\Windows\SysWOW64\drivers32\Warcraft 3 Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\WindowBlinds 4.x Crack.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Etherlords II Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe File opened for modification C:\Windows\SysWOW64\drivers32\Kings of War Serial Generator.exe 1e32c1a11141625b0134c415053ad5bb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3180 wrote to memory of 1808 3180 1e32c1a11141625b0134c415053ad5bb.exe 99 PID 3180 wrote to memory of 1808 3180 1e32c1a11141625b0134c415053ad5bb.exe 99 PID 3180 wrote to memory of 1808 3180 1e32c1a11141625b0134c415053ad5bb.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e32c1a11141625b0134c415053ad5bb.exe"C:\Users\Admin\AppData\Local\Temp\1e32c1a11141625b0134c415053ad5bb.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\$$$$$.bat2⤵PID:1808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200B
MD5598484818606c5661461719108cb3c42
SHA1ad95c97206903eed0d3c64c302a9b0b2fa16d47d
SHA25610057e83c5821a82d38abdff2dc24b625839684098a152f0929863874312ca0f
SHA5129fc87a478f5d1283c26b253fd572c025b2234393436850cf9d495f20ae9eae146542ef4a1abc0a09639b10063c9266de7058176b5adac622b963efb903a0df5d