6d67a6b7b72220845abe6f3b798f509528e43de3afa798dcf36047996cc4a27e

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1/Yuka - Scattered Shards of the Yokai/Game.exe
Size 1.5MB
Sample240511-phgfwsae99
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation	Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2776	Game.exe
2596	Game.exe
2596	Game.exe
2832	Game.exe
2596	Game.exe
2456	Game.exe
1928	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	Game.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2592	2596	Game.exe	28
PID 2596 wrote to memory of 2592	2596	Game.exe	28
PID 2596 wrote to memory of 2592	2596	Game.exe	28
PID 2596 wrote to memory of 2592	2596	Game.exe	28
PID 2592 wrote to memory of 2780	2592	Game.exe	29
PID 2592 wrote to memory of 2780	2592	Game.exe	29
PID 2592 wrote to memory of 2780	2592	Game.exe	29
PID 2592 wrote to memory of 2780	2592	Game.exe	29
PID 2596 wrote to memory of 2776	2596	Game.exe	30
PID 2596 wrote to memory of 2776	2596	Game.exe	30
PID 2596 wrote to memory of 2776	2596	Game.exe	30
PID 2596 wrote to memory of 2776	2596	Game.exe	30
PID 2596 wrote to memory of 2832	2596	Game.exe	31
PID 2596 wrote to memory of 2832	2596	Game.exe	31
PID 2596 wrote to memory of 2832	2596	Game.exe	31
PID 2596 wrote to memory of 2832	2596	Game.exe	31
PID 2596 wrote to memory of 2456	2596	Game.exe	35
PID 2596 wrote to memory of 2456	2596	Game.exe	35
PID 2596 wrote to memory of 2456	2596	Game.exe	35
PID 2596 wrote to memory of 2456	2596	Game.exe	35
PID 2596 wrote to memory of 1928	2596	Game.exe	36
PID 2596 wrote to memory of 1928	2596	Game.exe	36
PID 2596 wrote to memory of 1928	2596	Game.exe	36
PID 2596 wrote to memory of 1928	2596	Game.exe	36

C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7522d0e0,0x7522d0f0,0x7522d0fc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x98,0x9c,0xa0,0x94,0xa4,0xd6d820,0xd6d830,0xd6d83c
    3⤵
    PID:2780
- C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=gpu-process --field-trial-handle=1312,4429689635354414678,9353128229086686409,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai" --service-request-channel-token=E4B43FDA1BDE2BB0EDDC3447388F07B4 --mojo-platform-channel-handle=1344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1312,4429689635354414678,9353128229086686409,131072 --service-pipe-token=6ADFBCF34B95B81BFF411DD7644BDFD7 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=6ADFBCF34B95B81BFF411DD7644BDFD7 --renderer-client-id=3 --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=utility --field-trial-handle=1312,4429689635354414678,9353128229086686409,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai" --service-request-channel-token=8BF767B1A51F826BE4496A1A026B9086 --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\Game.exe" --type=utility --field-trial-handle=1312,4429689635354414678,9353128229086686409,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai" --service-request-channel-token=0B7A484E1612FA8BD2B3390F3C4225C1 --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences
Size 1KB
SHA256 e9afc93c7bfe5cee0652c6b6fbaa69394ec066c003d1c3b1e481b0697a3f0934
MD5 e3dee20001c3fbf75a64fdf56116eeb6
SHA1 1aba6736215ac5943941786c8fc5f5ffde3b3a0e
SHA512 4d63fa735826c543f01553c204153235914f78873c2ef39fea0f471e02fd832c98f5b55aa5da5627b22c3541cb75c13e87eefb1d04715783d9819d542c09a647
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 1KB
SHA256 d4baf2dcdd0427f6f5fe36e160d11d2e9664e460bdfedc4d79a2f3c9f2c689c2
MD5 ae7226d64aa07e5f8ace5c3039e33b40
SHA1 72b6afe57467b3bb7512935cf27fc7fddc2eaede
SHA512 bedaedabdbb222884891e900e2f8c55e6bbf0bffb30bc8d52b1ea6596eea5978e6e823fd7ab800e96f5469214dc09b4a37feb8043df336e95d6373d78be47ce4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 1KB
SHA256 e9a5299171633ba9a3d85ed280632e18fbd9b4e1d26a894428bd02f23d8bab34
MD5 4fce01442f5081dfb2f2e12748034084
SHA1 ca66eefa81473f0e8adb1af1e2430a36d19a313d
SHA512 0d8421cb8655546d3640c2be24519b847d84209213471ff5b8e15e9120e7e8662ca39db1d22653e951ab89a3ffe29fc11eb4ae3834437d154989e497d3ef8b49
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 3KB
SHA256 4f4e3f986842641a9c4976b0a6f15faaf11e5119a86145684390a0249890b252
MD5 241a15f351b249141c35184a9045f202
SHA1 f6c6e9e33242b9b3cdb51f5fb28d0c9cfcbb0516
SHA512 80d6eae402efe9700bc7715aeb462cd9b4972ef46f7971a293903f1eb59128e2c5efbe24b7b9edf11168929c5632d622c6a1f3ceee27ec9e63b7d5b878a92f3d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 ca9f398ad41061e13a551e200b891675e434a89d2a686f0e317df1d873c5bf4e
MD5 9e885e97110a1dd47a1a49535fb9d2f6
SHA1 7dbb49e06c5b74e3f2ef3b6f4f16ad68fb006c45
SHA512 89b51ac5688858464bc7aefd9fdd5d0fb524459885ad72e7515ffe260a3014cef3a8ee4a1aede3bc8a39cc8cc111b24d0ef7a01c5dd179dac575aa258f5968f6
MD5 SHA1 SHA512

Submit Download