Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Little Witch Nobeta Early Access Plus 13 Trainer.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Little Witch Nobeta Early Access Plus 13 Trainer.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
游侠网最新单机游戏.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
游侠网最新单机游戏.url
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
游侠网热门MOD补丁.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
General
-
Target
Little Witch Nobeta Early Access Plus 13 Trainer.exe
-
Size
1.3MB
-
MD5
3bc3f0fe207dbae4f4fe0a2e8c300a4e
-
SHA1
85759a013a1135bf452e47e9a282e683a7538993
-
SHA256
6a2780b68def659a958b7873ea3ebbb792119b5884b77a32d75f5fa2bb24192b
-
SHA512
3efd615c17721105d69ebbed352dbbe9857575ce2759eded0f4030e0b4e650054967927ea928687246937fb6c74f6b7ad16f0c87f5ccaa66621c6e94d97454bf
-
SSDEEP
24576:qSpS+y3KJdg/7pfEQaFQ+Rtf3yev8kC+4KFJqsCBh56FuksRDS:qTC/gj1Ta9Rtf3yekk7S5ouks
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Little Witch Nobeta Early Access Plus 13 Trainer.exepid Process 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Little Witch Nobeta Early Access Plus 13 Trainer.exedescription pid Process Token: SeDebugPrivilege 3100 Little Witch Nobeta Early Access Plus 13 Trainer.exe