Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 17:11
General
-
Target
Palworld 0.1.3.0 Hotfix to 0.1.4.0.exe
-
Size
146.0MB
-
MD5
61ac8392c96af5f5bad9085a16ae52c8
-
SHA1
69eb81d0796b434d18e8781fac88ca384560a7e3
-
SHA256
d36f8acca0cdc116dd026dc674091f710f8ddf3a246bf4d1a8e4f69db924c8bb
-
SHA512
1bdb8245106337c79f51a1708db65822ce1f4ee776fb8cdaf00605e1e107a22b23d11965c98b5bbafa68aed501d2b7cdace83f650ffb19b749d573bf2eaee6f9
-
SSDEEP
3145728:UojCLiaWvhBPdI6/TE2f0kCjhHDdwV6eRIgNRz6E9zfByir8adJR9YD:CrWDPdNbT0pjhH5wVd7Rz/9lyi9JwD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Palworld 0.1.3.0 Hotfix to 0.1.4.0.exe"C:\Users\Admin\AppData\Local\Temp\Palworld 0.1.3.0 Hotfix to 0.1.4.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GKLQO.tmp\Palworld 0.1.3.0 Hotfix to 0.1.4.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-GKLQO.tmp\Palworld 0.1.3.0 Hotfix to 0.1.4.0.tmp" /SL5="$A0208,152626678,176128,C:\Users\Admin\AppData\Local\Temp\Palworld 0.1.3.0 Hotfix to 0.1.4.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x3f41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55cdd44fdc8fb3fc334357c753483fb79
SHA1884867ca9a35f2132bd29aad209cf4eb29a79abc
SHA256648ac396838721a39226ab390bce79ab899092c86a72f268e8bf1a0ca5959696
SHA51235bdad8f629f2c59f19fbec60e906514a737a84bd3668f9cf17720479e98cdaa4eb7232ed05542b46b6fa06342a7f7431cb9acc94c9128960d2aaecf4fb087eb
-
Filesize
109KB
MD536946ab0740fa086bfc8b8a86260eee9
SHA157e154464dd247f14ec90de065d7be685dcc1293
SHA2569ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af
SHA51251a090119c36f19c8b008d52f1faf76ee1d511e151df777c577cf91da84300a8474d7e17004e3f374434b2d16eb1da3cfaee853e47528f9a1f6fb8bab71ed3e1
-
Filesize
20KB
MD54fb66af3052a25731d1f9c96bd17a654
SHA1d6c4fcdb1e5bd644365c52445a91075d4278b81a
SHA256c15e8ce6fe9cbf5ff30d3002619a55774f8c6198678cf6da26c6768f2a56b6fa
SHA5124e0ad7aece3b227d658bcaf401195803e5acfbed8e44ae2bc810ff862aacc264fc231585a5833ad587c17c30ea76ba9defed4c6108755462643bccaa28d94832
-
Filesize
30KB
MD5bfca8a245fc3a7fe7a3561aaf687cbba
SHA11b4dd6544baf59632198f6c00e48f741325abcff
SHA256f82e3de7d8d9a400e9d54348909a9ffa64a609d1644161ee40f7ae53c79215ff
SHA51290c924813a59015475717ce7b0271d503a3e3f365f25a62765e16d612c220b29ab7d665575be206758878f4927a420bf186acfc0cad1472ed4c9a12a44fd835c
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
16KB
MD54bafb0739c5fcd96be991f2a3cc9ac2f
SHA19372b03e4515660f732bf6338c4d7e183a78d2ee
SHA2567f74f1c445bf5e9456aae6fae695a8ca60e1d0eb5a2f44ac2cf0239a71f1a8a1
SHA512095946b16020d52beb25b4037775af8bbf6a7f15b56e260a1bf90af5ccadc11cbcb78c80540f087597a2df6bf5d6b2c8358249aed121ef68e96a302a9fb2ec55
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
320KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
40KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
96KB