Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 03:48
Behavioral task
behavioral1
Sample
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 62 Trainer v2.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 62 Trainer v2.exe
Resource
win10v2004-20240419-en
General
-
Target
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe
-
Size
1.9MB
-
MD5
de0c38f0c992cbd77133c7ec91d8c213
-
SHA1
a2602726f742db8262364d415ba58fd34da77d0c
-
SHA256
fecd1465e129e2490a37171a68be749b362568fa3673a4afba2aa50f8cce293b
-
SHA512
636cb2bc811604288997f571039232a9731b6fb8cf6b2973a88406834e5a883fe61a6ff3f7ce8c69ab46dbd843b602eafcac80e5a3e21a3b094fda6e867ab176
-
SSDEEP
24576:xpxh08edNXJ+SZTLGlarlbE/nGfn7haPECkDtGQjnEd6vVfacwDSfWB:xQNZFVil4bms2/kwonPvtac
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exepid process 2980 Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exedescription pid process Token: SeDebugPrivilege 2980 Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exedescription pid process target process PID 2980 wrote to memory of 2996 2980 Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe WerFault.exe PID 2980 wrote to memory of 2996 2980 Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe WerFault.exe PID 2980 wrote to memory of 2996 2980 Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200205 Plus 62 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2980 -s 8442⤵PID:2996
-