Analysis
-
max time kernel
16s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/09/2024, 19:45
General
-
Target
Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
-
Size
11.1MB
-
MD5
e15049206aee7b9d8742743290680f55
-
SHA1
d33895ec697909ddcfe779750024b7b22001322e
-
SHA256
5e4ad99f47e21b581accafb89835a19e905b78924fcabf347cd643772f1a17ba
-
SHA512
0f013733280b14382676b12d9779ac76e7791b8d20b1482e7beea8917b077f720974023eee7eb535a80d36467a8bef4bd38bbc12966b17db7884cce14c69be2d
-
SSDEEP
196608:c5mlDQxYNXVM3SnSTsrUoQIxbD/WdD92A25KGNNpHCh1fRoh/OkHRVEXI+62:ZlkxYNlM3SnSTK/WdD92A251Nt4Roh/C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in System32 directory 42 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x4041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
MD50f44b0b58a256744336e9fa164db348f
SHA13cdfbde28e8556537e74d50e05f19ae441e6bbda
SHA256049e33944ae998791d8507ca2ca941ea3378697efec0d93ec50b3babb24054eb
SHA512dfa6cda714eff62d6043b91f86757ca6722e9c5eb1768e895bf7ea3e04b95775a5a63711142005f38fbb081af4a6e19e34531789e6914ed9c244bea914d0b616
-
Filesize
189KB
MD5a65c29111a4cf5a7fdd5a9d79f77bcab
SHA1c0c59b1f792c975558c33a3b7cf0d94adc636660
SHA256dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
SHA512b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
-
Filesize
721KB
MD553d372ffd8b77d1f2d3c367208f29f07
SHA1ce05c99f43353e8eb2f7016fdf55e947e2da8b37
SHA256f4fde1d08dd6212ab2fcd71be96ce07cd60e18059aef4c2c94fd6cec2b746edf
SHA5122d0f5da710f266a72e01bda9e4def9629ea63ba0f5ba4149f93b9bd0db1149ba9b66337f531180f51608a922ca521f1ddad5a72f9971c07d8ffb4f890be3399f
-
Filesize
8.2MB
MD5caa9d29f5b5751a94a179328aaf7cc6f
SHA1698714c6cf34f5bc0b4372b6c88100c2ec9b5ff5
SHA25676892d1a377bf7a010d77e3c7b26e42369ba12ad066c3db71f05e361343e9aed
SHA5120a0360b737ea02d11bef8e8d65048b28730164c6db5567651e81586e4822faee72a0d3eee7146570fa2687627e524c54c1ade37d019a465112f428c0d6130e56
-
Filesize
6KB
MD5af18263191d6f3fe55af8bd455a947bd
SHA18cc06df49983bc95e71c678de9742eb5b0debbf2
SHA256a71d5867a2c1a25dfe7649549449024128dd5540a492da76856e150fdbe07feb
SHA512c55989158819d4bd7d17985508ffd7731c366ca1c79506c03a78d7e580f32aaa4d8cf4cf5e68bdf706df70780d25c0ab0a935be9d0c8d5bbeed9563dfb12f254
-
Filesize
289KB
MD5dacd337030c240f324a3d655ecd876e2
SHA1d108dcbd13ca07265085278c61d8a9f751a4905e
SHA256041427d5ae979b938fc2771bf3ae6e2b0cf6a669fc881b44be1586e46225532b
SHA51283f0343479ea0f92fa48264b70efbdafa5d54f3bce5e0b8be523cdf528eb7891754208e48e7f14df554c2832cf9758377542f9df0eba8c441ccb8cacbfbab08f
-
Filesize
480KB
MD59b8d650ffc6fff2cfe67a7e5c020ccfb
SHA1eaadc93c8e1af00cf01bf5fd8fb8d2792649d8b8
SHA25659b9f3fa57c1b7fdd3312f864c20eaee76ba9fcb7bb8d2542060d3533ced12c2
SHA512606818e23f7d214240e8724b55af72147b4ebb3ad1d1f036d33c4690e7f279ea1768a1db595ac06f3c4b348348fc61f546fda673359cdd4b762bce2de2b85e61
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d