Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2024 20:52

General

  • Target

    Combat arms Nx hack 2012/Combat Arms NX Hack Install.exe

  • Size

    37KB

  • MD5

    2c3b716252538188a68fafbed56700b2

  • SHA1

    32515c322d92c7387e5b441220e086355eee3bcc

  • SHA256

    19f69ee21431125495658109c70c539583e0cc14ad6c0f54650b2dc8fd58b165

  • SHA512

    14de627e03fa902f22e27b1a2f527d1d0f16b132b5d9b1873ee73145391ba44b53f61e1abd5a45aa013bc64f563d4d9ef07f42d5ffac24f9650b348109ebdee9

  • SSDEEP

    768:ydrRf/mmNm3xqFhtQzSOIVD5ZxYbJ7KP4s4p50VWFndiFJzuT6rwq:Y1/mmNm3YztQG9Fz6qAp5iWFndiF66rz

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\Combat Arms NX Hack Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\Combat Arms NX Hack Install.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:456
    • C:\Users\Admin\AppData\Roaming\iexplorer.exe
      "C:\Users\Admin\AppData\Roaming\iexplorer.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\iexplorer.exe

    Filesize

    37KB

    MD5

    2c3b716252538188a68fafbed56700b2

    SHA1

    32515c322d92c7387e5b441220e086355eee3bcc

    SHA256

    19f69ee21431125495658109c70c539583e0cc14ad6c0f54650b2dc8fd58b165

    SHA512

    14de627e03fa902f22e27b1a2f527d1d0f16b132b5d9b1873ee73145391ba44b53f61e1abd5a45aa013bc64f563d4d9ef07f42d5ffac24f9650b348109ebdee9

  • memory/456-0-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/456-2-0x000000001B6C0000-0x000000001BB8E000-memory.dmp

    Filesize

    4.8MB

  • memory/456-1-0x0000000000630000-0x0000000000640000-memory.dmp

    Filesize

    64KB

  • memory/456-4-0x000000001B0D0000-0x000000001B176000-memory.dmp

    Filesize

    664KB

  • memory/456-3-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/456-18-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/4492-17-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/4492-19-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/4492-20-0x00007FFCC6220000-0x00007FFCC6BC1000-memory.dmp

    Filesize

    9.6MB

  • memory/4492-21-0x0000000001760000-0x0000000001770000-memory.dmp

    Filesize

    64KB