Analysis
-
max time kernel
6s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-09-2024 22:55
Behavioral task
behavioral1
Sample
Days Gone v1.0-v1.04 Plus 35 Trainer.exe
Resource
win11-20240802-en
General
-
Target
Days Gone v1.0-v1.04 Plus 35 Trainer.exe
-
Size
1.3MB
-
MD5
d06b29acf88fdcc2f5dd049b2311967b
-
SHA1
b9910bccd7546409a270f7299d9f1287311d6215
-
SHA256
81830016defdd03ae9756b258ef6fd458bdf657bb4a3aa35d1a00268e2ec19e7
-
SHA512
e50a2060e642fb7c823e53758a4ade6a96ea7f44ac8e17757c433b7a9a4dfe39ab39aade1e12773f9b13fb45d30eae0e5bffabb555987dd2c2757178b7788910
-
SSDEEP
24576:95G91srHmUv5pSTKoGB9pKYW3LGPdXR1r33tVDSDfsbJ7:DHmiTSGoapg36lhtdlV7
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3936 Days Gone v1.0-v1.04 Plus 35 Trainer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2328 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Days Gone v1.0-v1.04 Plus 35 Trainer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2328
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD53e1f5eeae74491d8850ef2c8b03a9a3b
SHA10c02c9c2550107de6dd0eb740ac5668f292883c0
SHA25666756c0edf3925de7bcb685385e2a4f0b854cffd796a9e90eb1ed064b1fb0e30
SHA5127637f0807d88dbceeb68823a044583e2248ac1ba73c000da6560f94075635a27d15970df7e52f8315bdc2f1c45cff6f1ab7690e916b58307a533f8df24329c2a