b63f139340caed452ef7963a126a2a6738bf48d82c6cef2f8679eda816593400

Analysis

max time kernel
140s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Warkanoid2.exe
Size

244KB
MD5

491a89d1f71713873077213223fa3bcc
SHA1

50750290c07ccb21e5b4da2d396242952745519b
SHA256

5ccd786524e980b73e7c4e7c22c67436720a3741db346f2194679281d28b9c9b
SHA512

c2d16bdaafc134a72d3455d909aa45db0775b456c73f7d3798f29dbc72d6854738b70e210b5a592d8d77decf0bfb17a74c518e590d2528b217ed9fbbb8319011
SSDEEP

3072:0Ip0DRRcqFIMJ/GL7h/ukKxCQg/bvkdghUq/ayT7iwGLNM6td2ov9op+l4v/4u6g:0c0rEvh/NKxCQP07Tmg0A8A/4ud

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Warkanoid2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Gold Miner\crtlog.txt	Warkanoid2.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warkanoid2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warkanoid2.RWG
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RAW_003.wdt

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	Warkanoid2.exe
3876	Warkanoid2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 5024	3876	Warkanoid2.exe	82
PID 3876 wrote to memory of 5024	3876	Warkanoid2.exe	82
PID 3876 wrote to memory of 5024	3876	Warkanoid2.exe	82
PID 3876 wrote to memory of 5024	3876	Warkanoid2.exe	82
PID 3876 wrote to memory of 2072	3876	Warkanoid2.exe	83
PID 3876 wrote to memory of 2072	3876	Warkanoid2.exe	83
PID 3876 wrote to memory of 2072	3876	Warkanoid2.exe	83

C:\Users\Admin\AppData\Local\Temp\Warkanoid2.exe
"C:\Users\Admin\AppData\Local\Temp\Warkanoid2.exe"
1⤵
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\Warkanoid2.RWG
  "Warkanoid2.RWG"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\ReflexiveArcade\RAW_003.wdt
  "ReflexiveArcade\RAW_003.wdt"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-1-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/5024-5-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/5024-4-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download