dc2a165d64a0bd23fa0bd161ecc76665161ba742f4f591f72084ebaaf534fac2

Analysis

max time kernel
104s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
People.Playground.v1.27.5/Game/People Playground.exe
Size 638KB
Sample240511-mfe4yafc63
SHA256 93d8dfb94ade06c2d7d4ca47add7d6881ff70453016cc8d1cd14537cc86c06a8
MD5 5534465062a9089840568af130b7d0f3
SHA1 47b1b9670c57e945a630787b661ebc57fa6da787
SHA512 634e9c71f4ab5ee6d3c70abaecb0020d3fddc9eabcc03a7a0346b95d9c4c00db3fe30370670094ec7fd457d6d8d1491a7db19f70e1a2b49cd7068ebc9a5d3f7b
SSDEEP 1536:cC79gXAX271lcBzqEY2lkCswVxYDXosWkd09dluaUGX/9fpDBGQ6J5CYExyHQYY:pgXpJozm2lkCsuYDbMkZkBfx9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	People Playground.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	People Playground.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	People Playground.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3906287020-2915474608-1755617787-1000\{4E32AB48-837D-44BF-9D82-6A508353D25D}	svchost.exe

Runs regedit.exe 2 IoCs

pid	Process
3952	regedit.exe
2340	regedit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2308	People Playground.exe
2308	People Playground.exe
2308	People Playground.exe
2308	People Playground.exe
388	UnityCrashHandler64.exe
388	UnityCrashHandler64.exe
388	UnityCrashHandler64.exe
388	UnityCrashHandler64.exe
388	UnityCrashHandler64.exe
388	UnityCrashHandler64.exe
3588	PPGModCompiler.exe
3588	PPGModCompiler.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	regedit.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3656	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3656	AUDIODG.EXE
Token: SeDebugPrivilege	3588	PPGModCompiler.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2308	People Playground.exe
2408	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 388	2308	People Playground.exe	86
PID 2308 wrote to memory of 388	2308	People Playground.exe	86
PID 2308 wrote to memory of 3588	2308	People Playground.exe	97
PID 2308 wrote to memory of 3588	2308	People Playground.exe	97
PID 2308 wrote to memory of 3588	2308	People Playground.exe	97
PID 388 wrote to memory of 2728	388	UnityCrashHandler64.exe	103
PID 388 wrote to memory of 2728	388	UnityCrashHandler64.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\People Playground.exe
"C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\People Playground.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\UnityCrashHandler64.exe" --attach 2308 2255776190464
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\UnityCrashHandler64.exe
    "C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\UnityCrashHandler64.exe" "2308" "2255776190464"
    3⤵
    PID:2728
- C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\ppgModCompiler\PPGModCompiler.exe
  "C:\Users\Admin\AppData\Local\Temp\People.Playground.v1.27.5\Game\ppgModCompiler\PPGModCompiler.exe" 2308
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3952

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
PID:3952

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Player.log

Path C:\Users\Admin\AppData\LocalLow\Studio Minus\People Playground\Player.log
Size 16KB
SHA256 a076bd1a9cba3d0616954fd24024351d7497738e49311eb855a2c1d056c8eeac
MD5 a0215dee950b9caa63bd47432458aa7e
SHA1 7dbf7034764496979f07bcdf79aea9e719f16da6
SHA512 19d06854080bdaa4ad42579ce4e750b93cb1b6a360fadcce072aa220e8cf1c811b85d5da6e8c10332c2fbbc3f6f48ad5aaf1e82bc4226fad2e2a977f50092e4e
SSDEEP 96:FkHoB9SQQvSori4s1zTzzIckzwBWBKZBlOBozyBVgBPz9zE9m7eKBCBgEB7oBmB3:FHfSps0zm7HPE1uR+E1Em0FkXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2308-0-0x0000020D56D20000-0x0000020D56D30000-memory.dmp

Download

memory/2308-1-0x0000020D36C00000-0x0000020D36C10000-memory.dmp

Download

memory/2308-11-0x0000020D36C00000-0x0000020D36C10000-memory.dmp

Download

memory/2308-10-0x0000020D56D20000-0x0000020D56D30000-memory.dmp

Download