Analysis
-
max time kernel
47s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22-03-2024 21:42
General
-
Target
Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2024.03.08.exe
-
Size
1.7MB
-
MD5
3cab7de511d84567d768dcd225b842f5
-
SHA1
8044703032780636f9e215572995618beda90205
-
SHA256
f0854ba0a7771b27206c4c87a29bcbf6ca0993b97b3bc03dcc43754ead33c928
-
SHA512
416a93616909a039bf3ae7df199090b73400e8464f04f9fd02f6110c2e541815d98a64ee8c8824bf6be4068569ea530d1a0923c45e7690cd1ba0daa4bf2d9b56
-
SSDEEP
24576:gqNmAa+VkAB+aOB2jghQT8yNFhD5guD5UXDSVXT5Xjbqya:gqN3a+7BPOB2jgupN5HmkXT5Xy1
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2024.03.08.exe"C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2024.03.08.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
344B
MD57f210dd56d226b9f7caa77895c53428d
SHA1b0c00331a66a5fe11e2b840a1142259dd4e1f7ce
SHA256dd71ed6eb70ec1558b2b5fadcd69250bc1445a4e5321b6afbbe873522851f7a7
SHA5124f49b5a5a6afd8de916a2933570a8a85384db8ac8806bd1c40e0dc0d666183321de137ea30505e7a0692f3a83048d6cb50ddee2b7d4b10247a3d5928628fd17b
-
Filesize
242B
MD5a1934e9d0eeda55c0444e9a2f9290026
SHA106144618494660d2589b3860f195b5b1551af906
SHA256351fd3c2a5afad27da145a9e96b1b72a0fc60aa89d0ec1e4d0eeac73f868e8c8
SHA51256f779c2471937b067a24bf69b3e2295d6191f60d3c8dc2c2bf454af0b9385f5dcc446865b3cd2a56cfe96da493d1737a8bcd8d273140d104fe0f49850ce84d2
-
Filesize
242B
MD5ae55ed14416ebaaccdfa67ba61ddffa2
SHA1fda1b8dbfe4e3267d3b0ae0cee888fb0f9c3090a
SHA256be79d765e1dc9ed8b5d697f74f20ddd56ac8b5e1f448f423a270ddb19255bcb3
SHA512e66d08c40b5f39fb4136c0bfa58793effc5d4488ca6c92a81dcfed3aacd8949c3c48a73fe65ff833a0870cf4b9b382e44c234f2c2a6d0ec73441fbce8c91d3d6
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
40KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
208KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
4KB