Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 07:15
Behavioral task
behavioral1
Sample
2022年全部热门单机游戏及汉化下载.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2022年全部热门单机游戏及汉化下载.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
www.3dmgame.com.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
www.3dmgame.com.url
Resource
win10v2004-20240419-en
General
-
Target
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe
-
Size
1.2MB
-
MD5
f0c9746bc8ecd392d01f4c9b5252edbe
-
SHA1
b68af6e0e72cae2cf197c1ad092865ef1291eb3c
-
SHA256
d4e6652eb039b0e221c3e0cc43afa269f1e0f1c7fadd64c0e9b0848ab219bf51
-
SHA512
3a5993559e0ee25365d876c55c05da2379a3bb1f9fe5910bb00143af22d7efd9f4be3fcc8dd1557e7e1952a559f13c0aba5c51165a6a2291fa09db54f482628a
-
SSDEEP
24576:0lYPGio0sAC1VZoE5lg3DBOOsTo9ndFhsl63TDSKhhfbJ7:0uqlAezoE52TMris8LV7
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exepid process 2400 Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exedescription pid process Token: SeDebugPrivilege 2400 Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exedescription pid process target process PID 2400 wrote to memory of 2672 2400 Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe WerFault.exe PID 2400 wrote to memory of 2672 2400 Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe WerFault.exe PID 2400 wrote to memory of 2672 2400 Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Orcs Must Die 3 v1.0-v1.1.1 Plus 18 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2400 -s 8242⤵PID:2672
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2400-0-0x000007FEF5393000-0x000007FEF5394000-memory.dmpFilesize
4KB
-
memory/2400-1-0x0000000000500000-0x000000000053E000-memory.dmpFilesize
248KB
-
memory/2400-2-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmpFilesize
9.9MB
-
memory/2400-3-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmpFilesize
9.9MB
-
memory/2400-4-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmpFilesize
9.9MB
-
memory/2400-5-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmpFilesize
9.9MB
-
memory/2400-9-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmpFilesize
9.9MB
-
memory/2400-10-0x000007FEF5393000-0x000007FEF5394000-memory.dmpFilesize
4KB