Overview
overview
7Static
static
7b1921d4747...5d.rar
windows7-x64
1b1921d4747...5d.rar
windows10-2004-x64
1-warcraft-...I7.exe
windows7-x64
7-warcraft-...I7.exe
windows10-2004-x64
7.............exe
windows7-x64
4.............exe
windows10-2004-x64
4BNGatewayEditor.exe
windows7-x64
5BNGatewayEditor.exe
windows10-2004-x64
5icyHell.net.url
windows7-x64
6icyHell.net.url
windows10-2004-x64
3Warcracft ...ac.zip
macos-10.15-amd64
1Warcracft ...up.exe
windows7-x64
3Warcracft ...up.exe
windows10-2004-x64
3W3CDKeyGrabber.exe
windows7-x64
3W3CDKeyGrabber.exe
windows10-2004-x64
3icyHell.net.url
windows7-x64
6icyHell.net.url
windows10-2004-x64
3W3Fixer.exe
windows7-x64
3W3Fixer.exe
windows10-2004-x64
3icyHell.net.url
windows7-x64
6icyHell.net.url
windows10-2004-x64
3WarCraft3_...iS.exe
windows7-x64
3WarCraft3_...iS.exe
windows10-2004-x64
3icyHell.net.url
windows7-x64
6icyHell.net.url
windows10-2004-x64
3Warcracft ...up.exe
windows7-x64
7Warcracft ...up.exe
windows10-2004-x64
7FTkey.exe
windows7-x64
3FTkey.exe
windows10-2004-x64
3cdkey.exe
windows7-x64
6cdkey.exe
windows10-2004-x64
6icyHell.net.url
windows7-x64
6Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 23:04
Behavioral task
behavioral1
Sample
b1921d4747ed0ca08ecb31dda5b57079dcd6085d.rar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
b1921d4747ed0ca08ecb31dda5b57079dcd6085d.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
-warcraft-tft-keygen-F82Z5I7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
-warcraft-tft-keygen-F82Z5I7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
.............exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
.............exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
BNGatewayEditor.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
BNGatewayEditor.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
icyHell.net.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
icyHell.net.url
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Warcracft III Reforged/StarCraft-Setup-Mac.zip
Resource
macos-20241106-en
macos-10.15-amd64
Behavioral task
behavioral12
Sample
Warcracft III Reforged/StarCraft-Setup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
Warcracft III Reforged/StarCraft-Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
W3CDKeyGrabber.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
W3CDKeyGrabber.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
icyHell.net.url
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
icyHell.net.url
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
W3Fixer.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
W3Fixer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
icyHell.net.url
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral21
Sample
icyHell.net.url
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
WarCraft3_TFT_Keygen_by_CRiS.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral23
Sample
WarCraft3_TFT_Keygen_by_CRiS.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
icyHell.net.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
icyHell.net.url
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Warcracft III Reforged/Warcraft III Reforged™ Setup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
Warcracft III Reforged/Warcraft III Reforged™ Setup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
FTkey.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral29
Sample
FTkey.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
cdkey.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral31
Sample
cdkey.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target -warcraft-tft-keygen-F82Z5I7.exe
- Size 9.5MB
- Sample241108-22f1pasajc
- SHA256 fb3d286faee2cf6345988d4dd8c025688075e425a64c311439bed5d54461b0ab
- MD5 a959e89b1669d9657223e0708e60edca
- SHA1 5e6113b81512f75f7138994a72e7d1152ebbab05
- SHA512 bb183aede190f9886d18ee002ffaae6e66e485a4f8d0123887e37b622c63685f35f7beda400ea4118770491e962a48d401e29e9ed64f584e30b02df367702aba
- SSDEEP 196608:AW6aE7Lojzz2jXtfoZ08YKvF0n3mOr0ikl8UuYOOKDHoazb9keDC:OZ7Lszz2jX6ixKvF0n2Oo8wEDPkf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3564 is-9NUR4.tmp 4968 PCCleaner.exe 1324 PCCleaner.exe - Loads dropped DLL 3 IoCs
pid Process 3564 is-9NUR4.tmp 3564 is-9NUR4.tmp 3564 is-9NUR4.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 50 IoCs
description ioc Process File created C:\Program Files (x86)\Syney\PCCleaner\is-8E3D2.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-5AQ37.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-8FSNB.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-F6BHG.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\fr-FR\is-H9E7I.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\nl-NL\is-DH6J9.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-UD3E2.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-5VV17.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-9QJMV.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-LPMJF.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-IICVA.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\nl-NL\is-PIB29.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-01B51.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-RKG9Q.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-1023O.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-618AN.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-6LAGT.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-A9LS1.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-FI12A.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\es-ES\is-SP5M6.tmp is-9NUR4.tmp File opened for modification C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hu-HU\is-TBKI2.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ru-RU\is-M7QF2.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\tr-TR\is-UE70G.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-CESCP.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-05AG2.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ar-SA\is-SCV1D.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hr-BA\is-PQRCL.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hr-BA\is-99QKL.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\tr-TR\is-H7SKS.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-G1BNM.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\unins000.dat is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\el-GR\is-9VAV3.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\fr-FR\is-KPS9M.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hu-HU\is-N8HR1.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-DG7KD.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-9VSS7.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\el-GR\is-14M8D.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\it-IT\is-N9JPH.tmp is-9NUR4.tmp File opened for modification C:\Program Files (x86)\Syney\PCCleaner\unins000.dat is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\it-IT\is-C4G44.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\pt-BR\is-QBDTI.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\pt-BR\is-M22N9.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-A31B8.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ar-SA\is-BPVBT.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\de-DE\is-TUAD9.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\de-DE\is-VPC9S.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\es-ES\is-FCGJ5.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ru-RU\is-3AJE1.tmp is-9NUR4.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-B4I16.tmp is-9NUR4.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
pid pid_target Process procid_target 1076 4968 WerFault.exe 89 1624 4968 WerFault.exe 89 3968 4968 WerFault.exe 89 4868 1324 WerFault.exe 100 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-9NUR4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -warcraft-tft-keygen-F82Z5I7.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3564 3420 -warcraft-tft-keygen-F82Z5I7.exe 83 PID 3420 wrote to memory of 3564 3420 -warcraft-tft-keygen-F82Z5I7.exe 83 PID 3420 wrote to memory of 3564 3420 -warcraft-tft-keygen-F82Z5I7.exe 83 PID 3564 wrote to memory of 832 3564 is-9NUR4.tmp 87 PID 3564 wrote to memory of 832 3564 is-9NUR4.tmp 87 PID 3564 wrote to memory of 832 3564 is-9NUR4.tmp 87 PID 3564 wrote to memory of 4968 3564 is-9NUR4.tmp 89 PID 3564 wrote to memory of 4968 3564 is-9NUR4.tmp 89 PID 3564 wrote to memory of 4968 3564 is-9NUR4.tmp 89 PID 3564 wrote to memory of 1760 3564 is-9NUR4.tmp 99 PID 3564 wrote to memory of 1760 3564 is-9NUR4.tmp 99 PID 3564 wrote to memory of 1760 3564 is-9NUR4.tmp 99 PID 3564 wrote to memory of 1324 3564 is-9NUR4.tmp 100 PID 3564 wrote to memory of 1324 3564 is-9NUR4.tmp 100 PID 3564 wrote to memory of 1324 3564 is-9NUR4.tmp 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe"C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\is-4A4V3.tmp\is-9NUR4.tmp"C:\Users\Admin\AppData\Local\Temp\is-4A4V3.tmp\is-9NUR4.tmp" /SL4 $5021A "C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe" 9672036 481282⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
- System Location Discovery: System Language Discovery
PID:832
-
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 9044⤵
- Program crash
PID:1076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 9244⤵
- Program crash
PID:1624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 2004⤵
- Program crash
PID:3968
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "PCCleaner 1"3⤵
- System Location Discovery: System Language Discovery
PID:1760
-
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe" 1df4967a8b55e0254e559fb7330da0363⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 8324⤵
- Program crash
PID:4868
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 49681⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4968 -ip 49681⤵PID:4292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4968 -ip 49681⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1324 -ip 13241⤵PID:312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
- Size 9.4MB
- SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
- MD5 5bef7d0b672a3c1e4d0a8788df0d15fa
- SHA1 36a2264048fafb4629c333a50010513fa4fad088
- SHA512 73131d123a94ca676ea5fe012d202a0910cf10467d306dc3594fbeb3a0411e9767577b198b47ae470a1db21321d4c5b5e70a09e12e6a9c8baab8c854ef6dc083
- SSDEEP 196608:7rBiJT+MNrBhrBcOrBDXrBFwirBClwrBErBhKt1CGfUzVKN/LkoM:8x+q7SlIDhK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\is-4A4V3.tmp\is-9NUR4.tmp
- Size 640KB
- SHA256 620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
- MD5 8f284c81a024b01c3f7fa9b679a4ace2
- SHA1 cf611f807f00967cc02e303264829341442e462c
- SHA512 51f81e1bfb3b0b4c6b6b3bb1614ad8afab828aa0b38e4f9d1a298882f57c4214ca1a698a560841bba592c12a28b2e10f28fbf264c9121ab16dd3efbed7eaded7
- SSDEEP 12288:qh5UooqWolrP837JzHvA6izJgnnyFNmayiAZrvexOF:w5NoqWolrP837JzHvA6yknyWFxvexOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\is-EDD9L.tmp\_iscrypt.dll
- Size 2KB
- SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
- MD5 a69559718ab506675e907fe49deb71e9
- SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
- SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\is-EDD9L.tmp\_isdecmp.dll
- Size 12KB
- SHA256 58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace
- MD5 7cee19d7e00e9a35fc5e7884fd9d1ad8
- SHA1 2c5e8de13bdb6ddc290a9596113f77129ecd26bc
- SHA512 a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8
- SSDEEP 384:BGlcOuwieg7n8Ct6OMmLjrbhzlTQFLLHoOO/em:BGl/kQCnvvhzlTQxLIO
- MD5 SHA1 SHA512 SSDEEP