Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 12:12
Behavioral task
behavioral1
Sample
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
Resource
win10v2004-20240802-en
General
-
Target
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
-
Size
1.8MB
-
MD5
11db93fd5bb6f048922e584f6181dd45
-
SHA1
547fe0e358eb48b7c933e940c5efd8de0ad82286
-
SHA256
3f58c0fb65c6353a7beddaf59aa5e86431b959f6eea8a05d2d20ee5c962978d2
-
SHA512
fda67f65fd0998acad6ac5b55d5de8930ca42a8098f4ccb50860a660ce29734d986b70f97d01df85ac731fb38b0f35a5244813ba1906a5c5929dc5eee3d24cab
-
SSDEEP
24576:s1w4MNJ1kgD8TizIiT+x/fEITuQ05VwW3aPECkDtGQjnEd6vVfaceDSfWB:8e19ZzviYvhQ/kwonPvtac
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exepid process 1968 Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exedescription pid process Token: SeDebugPrivilege 1968 Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exedescription pid process target process PID 1968 wrote to memory of 2344 1968 Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe WerFault.exe PID 1968 wrote to memory of 2344 1968 Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe WerFault.exe PID 1968 wrote to memory of 2344 1968 Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2\Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe"C:\Users\Admin\AppData\Local\Temp\v2\Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1968 -s 7962⤵PID:2344
-