Overview
overview
6Static
static
334a6d2657d...cs.exe
windows7-x64
334a6d2657d...cs.exe
windows10-2004-x64
3HFUILib.dll
windows7-x64
3HFUILib.dll
windows10-2004-x64
3HuofengGameWorld.exe
windows7-x64
6HuofengGameWorld.exe
windows10-2004-x64
6IEAux.dll
windows7-x64
1IEAux.dll
windows10-2004-x64
1hfgwupdate.exe
windows7-x64
6hfgwupdate.exe
windows10-2004-x64
6msvcp100.dll
windows7-x64
3msvcp100.dll
windows10-2004-x64
3msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3sqlite3.dll
windows7-x64
3sqlite3.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
34a6d2657d9f3655e6513af83798be90_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
34a6d2657d9f3655e6513af83798be90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HFUILib.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
HFUILib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
HuofengGameWorld.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
HuofengGameWorld.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
IEAux.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
IEAux.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
hfgwupdate.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
hfgwupdate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
msvcp100.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
msvcp100.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
msvcr100.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
msvcr100.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
sqlite3.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
sqlite3.dll
Resource
win10v2004-20240426-en
General
-
Target
HuofengGameWorld.exe
-
Size
955KB
-
MD5
f034531a701044350969d768a825b60c
-
SHA1
8763743d1d3e4c8a3cf151de06b34e67cec88465
-
SHA256
11456913c0f21eeeb78a85ba0e3f6d7e420d1da47774f53c20973ccb89c04584
-
SHA512
a58495b929556edc955449b02ce4f92f21a9022a08d5b557d0107125b5493ecdad040e9813e2973b4f7fb3ab97acf2b0f7d7bdb7229412da42e97d4396816fae
-
SSDEEP
24576:af/yTb1kKxB7aQhVWxlvosfW+DwZzOPdF5OFN/wFC5aX:af/gbec7aQme+DwM52+g5aX
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
HuofengGameWorld.exedescription ioc process File opened for modification \??\PhysicalDrive0 HuofengGameWorld.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
HuofengGameWorld.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer HuofengGameWorld.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS HuofengGameWorld.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily HuofengGameWorld.exe -
Processes:
HuofengGameWorld.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING HuofengGameWorld.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\HuofengGameWorld.exe = "1" HuofengGameWorld.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\HuofengGameWorld.exe = "9999" HuofengGameWorld.exe