Analysis
-
max time kernel
1799s -
max time network
1751s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17-06-2024 01:11
General
-
Target
Plants-VS-Zombies-Game-Of-The-Year-Edition-Steamrip-com.rar
-
Size
75.7MB
-
MD5
cc7306208a5a2af54aee36fccb1297fe
-
SHA1
f5e4296f909c60403d32e4d5652cedb51406fe3b
-
SHA256
541d0a7d8ba42e1abee5ba2fb9e79876468f014bdf082e77047cd288eb28ccc6
-
SHA512
7bce0195be710ff9d0f54890126bfd6958b9dbbe2548175112bde86803b7e129797ebfc00120811d6a37ddcc36f43f04f70e02c3dc071daaab7fa3952285c000
-
SSDEEP
1572864:+k2El0vhua3Qx/MdFiXgpMs1kTfx0qU/nn3tBUKKjGQts+apoqspWi7HrJ:qp3QxEPiXgpMJTfxc/nn45iQt5H2SHrJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 46 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Plants-VS-Zombies-Game-Of-The-Year-Edition-Steamrip-com.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Plants-VS-Zombies-Game-Of-The-Year-Edition-Steamrip-com\" -spe -an -ai#7zMap32127:190:7zEvent244681⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Plants-VS-Zombies-Game-Of-The-Year-Edition-Steamrip-com\Plants vs. Zombies GOTY Edition\PlantsVsZombies.exe"C:\Users\Admin\Desktop\Plants-VS-Zombies-Game-Of-The-Year-Edition-Steamrip-com\Plants vs. Zombies GOTY Edition\PlantsVsZombies.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Taskmgr.exetaskmgr.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD592325191721c8cf6addf0e95d033207e
SHA1a9878afb783e4aca350fcbe04e3bc07b08cd60aa
SHA2562b80f94048c70272ecedafe822fbebf967bb77c041db89f63c9b3258b485ceb5
SHA5127c387f403e4f5ec55f72b6e8d898e30aa40f8892baa5c1424111349d65510b633f66fdc6e739f40b6fc1d0746a4fb1fc80e9b1834987ea79e0e2ccd8be36dc88
-
Filesize
10KB
MD5e9aa12ff0be6d995ed86f8cf88678158
SHA1e5ee38fc2ebef0fcbc3059dee29b39f7daf21931
SHA256f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561
SHA51295a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc
-
Filesize
10KB
MD5f6cf8a445e1a471d6dff34d1abb8efdb
SHA157e4448a4b9475bb529dd7bb3a9808e6e0400b76
SHA256355f4081dc19d2bfd40aa473a1f76ff02912cf04906b9af9dd62edb0646e1c5a
SHA51264e33a1eb07c42dbd55ad342b35b34487b9a659205e0f0a5f6605135f5b710deb4882af894fb1c807e0d48a5acffdf3911740ae6c0eacaa4c173f64351deb3d2
-
Filesize
3.4MB
MD5d87a32d1be3e8bef5edd8100486b06f8
SHA196e9c4e7ac8963638ba9b06bd08badf8bc7c87ac
SHA25648e28b4a6838061d49d4d83fe891320235b0895208e30e199fb21fd89980a672
SHA5129657d1d31c369e677000bc8e1117ec4dd0a69334312faa433fc4975c7cfb1157a2f64dbb1ca125b8f1bba1d5510948ddd3f40409ddd818127bd09da9ebe1b648
-
Filesize
90KB
MD56731f160e001bb85ba930574b8d42776
SHA1aa2b48c55d9350be1ccf1dce921c33100e627378
SHA2563627adef7e04dd7aa9b8e116d0afc11dcee40d0e09d573210a4f86bdc81a80b6
SHA51207ae0cb85464b015b35e6157228775a6ac66e5e62a1b47f9395307b61176b6df835e00a1518846507718acffc271263008cc8a9b2c1e8a0192c5438774e12437
-
Filesize
43.3MB
MD526392c2433caff44251b9eecd4500546
SHA19d042fd889151627a4a05451f50c52c1ebc1a6f1
SHA2565878326408285cb01f83b4fa4edcc66d65e727f6d6ee88563b5b3b287dd259fc
SHA5124e3d75f34f6b1d192dae693b3baccb32b84d6877a0c355c75a0959d62b179fda46133819e7512c409cc5b0033741966abc3e0ce665000703e836b5e7d3a61c1c
-
Filesize
2KB
MD58ed72e354fe6a65452203fa8af42bee5
SHA152d7b0a691822d4a302ea633d1e7a68f611b6888
SHA2564a051495830ca117435c2972dda5af7a4355d33964d904c335eb140dcf2e904c
SHA512e06ad321fdeea3a08d64859fc25d41d2de36e1dae02ebf778ebaadfaa90ed06229e60f3f3c4bdc4ad3bbe6808b9e175528620ea62f2dd30cba9c0d2c37169fe8
-
Filesize
667B
MD503e40048514022bc30a95dd4129ea85f
SHA1be5833c0eac7aa145c4ac827ac54fe6ead280892
SHA2564e7ff623b419e36feb578eaccb5e80b838290b01c2d2ae282a0648cecbd80290
SHA512c85d3faeb98196896f0c269bd194dbfaf9aa42df833b1ddcedc2464ccc02c90f2583fd0a271e2e0cf244e357d5fcb2d9c0feb2c5a35c0a1088f6f2dea9a4b5ee
-
Filesize
24B
MD543692852271755b4b8a3700255e144cd
SHA10c25a72a1ee4006b0a63dfb2b9c0369fedb688ef
SHA256ca5b57ce55e4c7dac8086656e7b63c41d56e1cc98a6208391f6fbfa800887537
SHA512bb89a39489647a9aac58cda774573f169eaecfdc8d606708dbaefc62a7a2257036bec74bff65c35d0cd6f4cc9c266284895dbdd7dd087b5ae9ff11436b53986b
-
Filesize
5KB
MD5834e499dfc1116d26c3b229f69019149
SHA16eb52bf63ec5265faa360abebf2b7f634696f0b1
SHA2568bea233c40ddf74decf3ddd0a3d4cef8e1229ca3a756384e78d319aca0b63113
SHA512c5ac5f9b41ff6af9d132c0f4c8a9e6a841261f24bd7e9eaac1864d87489639516af348271e11b60df959711d65af9bdc59337d0d6a718cbd10f17beefd93380b
-
Filesize
113KB
MD5c6577b2e9c7c3e98799081534de8494f
SHA1730a6770f80f6bc6beeb4cd58f441d9f756c353d
SHA2568d567f209dffdac48e3f65acdf94b33d076b908df63eb531602437987a708b82
SHA512e82691e86093bd1d76d2dcb1aeef0f37ae69847099e0efcd97d689a54a2f1323fdaee7de266b1f9aff35cde4a0129f125113646816ead073e3a757189805fdcb
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
