Overview
overview
10Static
static
10Battlefiel...all-sh
windows10-1703-x64
1Battlefiel...est.sh
windows10-1703-x64
3Battlefiel...lat.sh
windows10-1703-x64
3Battlefiel...at1.sh
windows10-1703-x64
3Battlefiel...ian.sh
windows10-1703-x64
3Battlefiel...eed.sh
windows10-1703-x64
3Battlefiel...eed.sh
windows10-1703-x64
3Battlefiel...ose.sh
windows10-1703-x64
3Battlefiel...nts.sh
windows10-1703-x64
3Battlefiel...st.exe
windows10-1703-x64
3Battlefiel...PY.exe
windows10-1703-x64
3Battlefiel...al.bat
windows10-1703-x64
3Battlefiel...tf.dll
windows10-1703-x64
3Battlefiel...et.dll
windows10-1703-x64
3Battlefiel...es.bat
windows10-1703-x64
1Battlefiel...ts.dll
windows10-1703-x64
3Battlefiel...nv.dll
windows10-1703-x64
3Battlefiel...tl.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...-0.dll
windows10-1703-x64
3Battlefiel...rol.py
windows10-1703-x64
3Battlefiel...sh.bat
windows10-1703-x64
1Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel...st.exe
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel..._r.dll
windows10-1703-x64
3Battlefiel...ns.xls
windows10-1703-x64
1Battlefiel...lp.xls
windows10-1703-x64
1Battlefiel...or.doc
windows10-1703-x64
1Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-07-2024 00:21
Behavioral task
behavioral1
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/install-sh
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/boolean/test.sh
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/coarsen/flat.sh
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/coarsen/flat1.sh
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/cartesian.sh
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/cartesian_speed.sh
Resource
win10-20240611-en
Behavioral task
behavioral7
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/random_speed.sh
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/too_close.sh
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
Battlefield 2/NavMesh/Navmesh_SDK/gts-dice-0.7.3/test/delaunay/two_segments.sh
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Battlefield 2/NavMesh/ObjectTest.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Battlefield 2/NavMesh/ROBOCOPY.exe
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
Battlefield 2/NavMesh/SaveQuadLocal.bat
Resource
win10-20240611-en
Behavioral task
behavioral13
Sample
Battlefield 2/NavMesh/asprintf.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Battlefield 2/NavMesh/charset.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Battlefield 2/NavMesh/fix_navmeshes.bat
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Battlefield 2/NavMesh/gts.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Battlefield 2/NavMesh/iconv.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Battlefield 2/NavMesh/intl.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
Battlefield 2/NavMesh/libglib-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Battlefield 2/NavMesh/libgmodule-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Battlefield 2/NavMesh/libgobject-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Battlefield 2/NavMesh/libgthread-2.0-0.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Battlefield 2/NavMesh/navmeshControl.py
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Battlefield 2/NavMesh/xpack_navmesh.bat
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
Battlefield 2/PCRegExp_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Battlefield 2/RendDX9_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Battlefield 2/SoundEngineTest.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
Battlefield 2/SwiffPlayer_r.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
Battlefield 2/TextureAtlasBuilder_r.dll
Resource
win10-20240611-en
Behavioral task
behavioral30
Sample
Battlefield 2/bf2editor/Help/CommandDescriptions.xls
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
Battlefield 2/bf2editor/Help/ObjectEditor_Help.xls
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
Battlefield 2/bf2editor/Help/Tutorial/How to create a destroyable object in the Editor.doc
Resource
win10-20240404-en
General
-
Target
Battlefield 2/bf2editor/Help/ObjectEditor_Help.xls
-
Size
81KB
-
MD5
9a57d4ebfe7aff0bb2d94a7c3e256ea7
-
SHA1
52ec0d72461f261c208d919bcbb6ce7948d5cca3
-
SHA256
350505f74434ceb77df2806146d4cf12c8893f52f2fad0926e47c15220707615
-
SHA512
53bb12d5a854582b2bcd96c20283ad95e6d034dea207a20945a8dc87e7967f6380525fe5b0348d3b2b3826d216a2d1b3e23de05a459cacee87405c0344ccaf8d
-
SSDEEP
1536:Z9gX5o505CLU5g8rjgP82J4jUz9W4YGDr3S4nAWvi2daf5hjNJs+G8sxG4tyCutu:ZNJoU4jNq
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4116 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE 4116 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Battlefield 2\bf2editor\Help\ObjectEditor_Help.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4116