Overview
overview
7Static
static
7Heaven.Wil...ne.exe
windows7-x64
7Heaven.Wil...ne.exe
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...ne.dll
windows7-x64
1Heaven.Wil...ne.dll
windows10-2004-x64
1Heaven.Wil...UI.dll
windows7-x64
1Heaven.Wil...UI.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Heaven.Wil...le.dll
windows7-x64
1Heaven.Wil...le.dll
windows10-2004-x64
1Analysis
-
max time kernel
247s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 06:02
Behavioral task
behavioral1
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TerrainPhysicsModule.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TerrainPhysicsModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TextRenderingModule.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TextRenderingModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TilemapModule.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.TilemapModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.Timeline.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.Timeline.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UI.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UIElementsModule.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UIElementsModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UIModule.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UIModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UNETModule.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UNETModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityAnalyticsModule.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityAnalyticsModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityConnectModule.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityConnectModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestModule.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestWWWModule.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.UnityWebRequestWWWModule.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.VRModule.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine_Data/Managed/UnityEngine.VRModule.dll
Resource
win10v2004-20240802-en
General
-
Target
Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine.exe
-
Size
635KB
-
MD5
42b6538cdaaf017a408b1bf04e0cf28b
-
SHA1
ef28a03d80df05954786689f95fe7a942099f335
-
SHA256
76aabbd06c5dc729ec68d9bed383e2a18711bb286f62e5136d3682c6c852ddd0
-
SHA512
a8575c03c6e20e3dc9602b5bd4fa13b7dd7f5bcc7f816dc6e95b561e00f5f504931891b3ded3147d6a05eaa217e5e8e00739b3473f0bfc9ed3b65a9785bd9de8
-
SSDEEP
6144:V9fYunoPZRR1/FJ416Q7dbMdKVfl1llT+HYsSO/wF3a89QnQnPC8g/O4FIoCBuA1:E+oTnFJ48kQ+PFO/wjQnQPI20uu1K9
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1664-4-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp upx behavioral1/memory/1664-7-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp upx behavioral1/memory/1664-44-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp upx -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HeavenWillBeMine.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HeavenWillBeMine.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz HeavenWillBeMine.exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HeavenWillBeMine.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1664 HeavenWillBeMine.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1664 HeavenWillBeMine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine.exe"C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664