Overview
overview
10Static
static
10Battlefiel...all-sh
windows10-1703-x64
1Battlefiel...est.sh
windows10-1703-x64
3Battlefiel...lat.sh
windows10-1703-x64
3Battlefiel...at1.sh
windows10-1703-x64
3Battlefiel...ian.sh
windows10-1703-x64
3Battlefiel...eed.sh
windows10-1703-x64
3Battlefiel...eed.sh
windows10-1703-x64
3Battlefiel...ose.sh
windows10-1703-x64
3Battlefiel...nts.sh
windows10-1703-x64
3Battlefiel...st.exe
windows10-1703-x64
3Battlefiel...PY.exe
windows10-1703-x64
3Battlefiel...al.bat
windows10-1703-x64
3Battlefiel...tf.dll
windows10-1703-x64
3Battlefiel...et.dll
windows10-1703-x64
3Battlefiel...es.bat
windows10-1703-x64
1Battlefiel...ts.dll
windows10-1703-x64
3Battlefiel...nv.dll
windows10-1703-x64
3Battlefiel...tl.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...rol.py
windows10-1703-x64
3Battlefiel...sh.bat
windows10-1703-x64
1Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel...st.exe
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel...ns.xls
windows10-1703-x64
1Battlefiel...lp.xls
windows10-1703-x64
1Battlefiel...or.doc
windows10-1703-x64
1Analysis
-
max time kernel
127s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-07-2024 00:21
Behavioral task
behavioral1
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/install-sh
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/boolean/test.sh
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/coarsen/flat.sh
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/coarsen/flat1.sh
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/cartesian.sh
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/cartesian_speed.sh
Resource
win10-20240611-en
Behavioral task
behavioral7
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/random_speed.sh
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/too_close.sh
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/two_segments.sh
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Battlefield 2/NavMesh/ObjectTest.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Battlefield 2/NavMesh/ROBOCOPY.exe
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
Battlefield 2/NavMesh/SaveQuadLocal.bat
Resource
win10-20240611-en
Behavioral task
behavioral13
Sample
Battlefield 2/NavMesh/asprintf.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Battlefield 2/NavMesh/charset.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Battlefield 2/NavMesh/fix_navmeshes.bat
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Battlefield 2/NavMesh/gts.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Battlefield 2/NavMesh/iconv.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Battlefield 2/NavMesh/intl.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
Battlefield 2/NavMesh/libglib-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Battlefield 2/NavMesh/libgmodule-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Battlefield 2/NavMesh/libgobject-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Battlefield 2/NavMesh/libgthread-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Battlefield 2/NavMesh/navmeshControl.py
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Battlefield 2/NavMesh/xpack_navmesh.bat
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
Battlefield 2/PCRegExp_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Battlefield 2/RendDX9_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Battlefield 2/SoundEngineTest.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
Battlefield 2/SwiffPlayer_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
Battlefield 2/TextureAtlasBuilder_r.dll
Resource
win10-20240611-en
Behavioral task
behavioral30
Sample
Battlefield 2/bf2editor/Help/CommandDescriptions.xls
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
Battlefield 2/bf2editor/Help/ObjectEditor_Help.xls
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
Battlefield 2/bf2editor/Help/Tutorial/How to create a destroyable object in the Editor.doc
Resource
win10-20240404-en
General
-
Target
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/coarsen/flat.sh
-
Size
260B
-
MD5
556ee324ec5423a38a68145108295be5
-
SHA1
034454f4f8d7866d27e61b73df283b3423e733c1
-
SHA256
228c1bf5b3e464e38be543a6aef4a1a7153e9d73bd851b42ad7e7cff72f5340f
-
SHA512
e10fdb658045b76274a5117a2549530c45306a08a17aa592e386df1092fa4da043a4bd50e277c6409279d215e5a367b40acc8958a08724af5a63a5ec5aa4f96b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 864 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Battlefield 2\NavMesh\Navmesh_SDK\gts-dice-0.7.3\test\coarsen\flat.sh"1⤵
- Modifies registry class
PID:4128
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:864