Overview

overview

7

Static

static

3

2629/FarCr...un.exe

windows7-x64

7

2629/FarCr...un.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 08:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2629/FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe

  • Size

    4.0MB

  • MD5

    d408e8a8056bdcf9e1d569cd211f6efc

  • SHA1

    99fd4ff079ed73573848492504cb5712f2067040

  • SHA256

    587e14af969e26467c73d7b4e74bb02e39e4750127a56601cdbf9060d3728b9a

  • SHA512

    d6100d61f788e2d94560c6ca7931d4bf919c20ed6de1ea4140cbfe1d444004fa64f71cbcd502b44398d157f0120f578ce653834ea04555d4c549cb07f68bcd21

  • SSDEEP

    98304:+vEFsNsvGS7+3PCbPROeIZ0Ap0mYZBsv8NGfhIB7oWlmfWQ6RTbG5/AEcoUfS:O4sWvGBPCbPUTavNGfhIZbm+m5jct

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 45 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2629\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe
    "C:\Users\Admin\AppData\Local\Temp\2629\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\2629\"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe
        "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\2629\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c start http://mrantifun.net
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://mrantifun.net/
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2640
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\CET_Archive.dat
    Filesize

    3.8MB

    MD5

    18c8cd69b4864a5a1cfbd2a821ec497b

    SHA1

    6e922bda9a311c9abef40af9623da948ad490572

    SHA256

    e0c0e073a7db8150b29046e414d6424ddbe834d130bcf56ff6a82e4f4b86e81f

    SHA512

    b0dfb1b2114baf6eb079c7075b28086f4397557f4d7bf1b71e869b00a9e0f27c8ae0d0be8d05c17eed8bbe6681fee3f7574def618290844d9f4f79f77bbc745a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe
    Filesize

    196KB

    MD5

    808de473370ef6b5d98ab752f245a3ca

    SHA1

    800bd4ad10c17471829693fac3cee4502b14f029

    SHA256

    65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39

    SHA512

    fafaff03ad502523b3627e59e1026b8af4217a80215782a90667bc4f4c330871d8c3d890f2601b68ec9a42c0171d12b9e5b87067c95dcad1132b0a8979c56a4c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\CET_TRAINER.CETRAINER
    Filesize

    221KB

    MD5

    bdfae0c7601c5fe3b1fefbb2c485c02d

    SHA1

    ee532f617c1d29cc2dc0ce26f6e1f7077d54b61c

    SHA256

    5b2508a471842b8e88dcaf0844889565075b3eaad7b8646eb07a3b8eec43011c

    SHA512

    9e4877dd3bff34c894f0843f1f491c295c2710617b0557ddaf8d6863d512c3af6fbf43035d3658dc248b82295ce2c59d2d365937004e5837a4e144aa7006609d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\defines.lua
    Filesize

    5KB

    MD5

    d8f9b4a10a48ebd8936255f6215c8a43

    SHA1

    7d8ff0012fa9d9dcf189c6df963f1c627f2ccb76

    SHA256

    d4347332b232622283e7dd3781f64966bd1097d06cca7052b467cf99e62898f2

    SHA512

    67db5dc65fef66fe3a1920c5f406091d17eeae27266039af392a166d63686b8fc61b94684f2b97762995aefa42d2d15148213ecef64cc0df04de19320abba97a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\lua5.1-32.dll
    Filesize

    329KB

    MD5

    2730ff589ae86ef10d94952769f9404f

    SHA1

    8010834297a6aa488e6bf90eceaaf9e60bb60c6e

    SHA256

    faf0850051ba175347e40481da9e2cc3a122a09d428925042932be555db06e6b

    SHA512

    5fb35eb364603568b67ce0d19371016a382bc62500de807a12492ceacd5d2b765e0908e2e7e9798446b6c005c0e48c0da74c1a0f9d55c49a8ef4eb3c3d1307e0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\win32\dbghelp.dll
    Filesize

    1.2MB

    MD5

    9139604740814e53298a5e8428ba29d7

    SHA1

    c7bf8947e9276a311c4807ea4a57b504f95703c9

    SHA256

    150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f

    SHA512

    0b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\cetrainers\CET1A16.tmp\extracted\FarCry 3 V1.05 DX11 Trainer +10 MrAntiFun.exe
    Filesize

    7.4MB

    MD5

    7be0f90c526a7dcbe40c2b6d5db884cc

    SHA1

    afaf6106f912f9ca8703fe8be2114c1d47121fdb

    SHA256

    c53cd508cdf0c218876e6ff23ffa496d51bd7a231e5a64f86ca3af46b0402fbb

    SHA512

    698011935a3e5a83dd69689c48b0414e85625d4b1e502517854d435e3af81e84aca1112232a0943c123e7a81d0d141781ce30612f64ec90ffc7d93c75d6f93e9

    Download Submit

  • memory/2560-25-0x0000000003A30000-0x0000000003A31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2560-23-0x0000000003A30000-0x0000000003A31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2560-27-0x0000000003A30000-0x0000000003A70000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2560-48-0x0000000003A30000-0x0000000003A70000-memory.dmp

    Filesize

    256KB

    Download