836baa17bbd8f5f58717d4f717290f3898253227c893b344c0897d67f898572b

Sharing

Copy URL Twitter E-mail

General

Target
Age Of Empires Kings-Conquerors-Forgotten V2.rar
Size 694.8MB
Sample260701-c15j8acy7j
SHA256 836baa17bbd8f5f58717d4f717290f3898253227c893b344c0897d67f898572b
MD5 b4b814c600131ba5f977ffa1bb8f39f3
SHA1 8df40b1cdf09ac06fb3537b2beae18d33d3d5afc
SHA512 2b58c95a5b181d2e890fdef7831d3700f8163f0106747484b80b1b8714dc52afc7f1bdf0d8f722a2fdabad8f91e4a234faf57e9b7482c81a4385306977009e30
SSDEEP 12582912:3quZrYNbU/0bFuWnvEeRTpqhLDcOnaCX7rOaiguq8G2Y4K8pVPkNNUeIOwL:3quRYNrbXlcLDla4r7SGeivU7LL
TLSH
T1B6793329FDAE24E9C83A921BA7D4F4AB3744B0A33D81FBD1856907A730C46F04E16775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/Data/closedpw.exe
- Size 28KB
- SHA256 590e854edcc519e096c5b98a925f8fc28bd5f09028ac660043017e279ef0b63e
- MD5 6295c1c28ab5bbba657d448308830dfd
- SHA1 c403e034343a1aebc1909c305177465c6dfbada0
- SHA512 87c90efbf97e03a867ee7f4726d61e3468dfa56adb4dc6c199b51c083724225bb3e712e60489a9159128dae105f073065880413f4d424652ef698442c6550f71
- SSDEEP 384:xrdva9M6hdeviFJcNhQJZ20gu2cEEMVf25XMQnk9tR4MqsymzWq:xqhIiFw42c9Nm4puW
- TLSH
  T1A3D23A0BE5C192B2D4D1163C10F76B2AD6771A3903B24AC7D7C94CB66931DC0693C6CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/EBUEula.dll
- Size 52KB
- SHA256 fd3c74cb303a6d713fe1e273e3879f2d2fd080b87ee165d8a0bbff61ae28f377
- MD5 ecb285eed84bd14de5fc6957d5a10e28
- SHA1 7cc61ab16f36bb0e29ce447e45fc787357a07e4b
- SHA512 81c6171b3f823e866bf2757de82e619cc12c9fad0158e7bee5e2a5dabcda7456eeb6f0edc48b172ab7702ea20bd3788d8057cb7e96e112f2759a1068fba5edc5
- SSDEEP 768:YK3zN1ueiylV4CT3bIMoP0iB9h/TarSlWMS5ohIRh+5qlNMV:YK3Z1inCT3NozSgWfo6lm
- TLSH
  T11733F81166F686A3F1F3AA3465B507A38F3EBD026AB5844FCB20565E0D70E80CD25B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/EMPIRES2.ICD
- Size 2.4MB
- SHA256 84244ee64b8f9c81395ce068487cc81f7d2fa1d24f45400e5503fcd7699defc1
- MD5 44292defa4766b2a9782a0d0a22c2788
- SHA1 92dad2ef740308f82be58fce44b406d4b47509ca
- SHA512 886e31ca5eaf41666683c945bc629beb870b8fbb4db0368ecb3b563fc361c34a86a4c22c74bb24b6e9e94c8a7a5a9c3782355e2eb017f30c396ce4b0a4d14e9f
- SSDEEP 49152:B2dDcwO/UiwQQeGC6ndvPMR9n6KTwiiefqTJLZ915hYIVCTIm/S155:xwO/jwQQrTdH8NH9hfqTJND5hNoTIm/4
- TLSH
  T110C5DF57EAA94B9BEED5CB72BF961B9069D361E389E1DF021C1C170C08316A01F177B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/Games/Forgotten Empires/Data/language_x1_p1.dll
- Size 103KB
- SHA256 54cee8aaa06a489adb21f9da25c796dccb0d63fd4755545acc44326f19160058
- MD5 665dc77c7975c7d0434633af361388b7
- SHA1 9feb4f9136aa07ee3d9102e966b578d084845309
- SHA512 510a48eebf260a595d579c2db520abfefdbd3d1bd28d53609864bc8ddef36e04153465a73bf2115b9cf74043da75b09c998d0960da31d3d60f6926253600e0e7
- SSDEEP 1536:ONqwfXEk4yuNjbjO3bs+7X0TCWRmVLgjztiFPWf8oFaW7dFowP1:AfXf4DfS24WZ
- TLSH
  T157A3205197F85205F6F36F35ADB926A98E37BD92AD3DC12D0200525D9EB1E08DC28B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/Games/Forgotten Empires/Data/language_x1_p1_original.dll
- Size 103KB
- SHA256 b8755e606f2ecdf0974077a988f29188a95c5f0dba723d436e02f5302e608730
- MD5 2da59bfa11bc8d08795eebf460aec8b1
- SHA1 d071d589fa52a0bc9591ce866fc2b74dadc46dde
- SHA512 32abd860fd5d5cf9b2f64d2136657f64bf0d5f09e824e612785524bf33df1ad323ce47ff47409b17e3f391f96f455937b8fdcd088114eda2586baf4bcbc432ab
- SSDEEP 1536:vNqwfXEk4yuNjbjO3bs+7X0TCWRmVLgjztiFl8H8oFHW7dFowP1:vfXf4DfSq5WZ
- TLSH
  T1BAA3205197F85205F6F36F35ADB926A98E3BBD92AD3DC12D0200525D5EB1E08DC28B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/AOCCONFIG.exe
- Size 177KB
- SHA256 e8578e76c7b11c2889a0ebf23234329d0d2f0d82f8db49fe73fd913565576a5c
- MD5 94ea2e79b1e9fda85e813055b1eae157
- SHA1 4c439ffdf7e14c03c5fb2d679468783e807d4f3d
- SHA512 7bf68700cccff2cfecc9ea75d5341079ae6a58161265f073e039cc72f5d1a8478e31c4142ede142ef71e4bc28600aa336a5363af8363dbc406c77aca1feee627
- SSDEEP 3072:csIUCiB9yXk9nTfLZ5HHfOvFFvf3P++Z947bXjTHkP70MFB45Nzn2zQZbymgEUkW:cfHXCnTfLZ5nf6PRKHkP4jNzn2zAymgr
- TLSH
  T15F04130957102F6AC491607B4BC28FB0AD1419B60AF28FD6D9B7F42FB81B2B7551287F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/Age2-Paso2.bat
- Size 61B
- SHA256 6d8e8ce8773eaed0d4fa93088d503218f07b21f483ca2e3b9c4ed0035a73c33c
- MD5 a373ba2770aa5a5cc25f3ac14c3ff161
- SHA1 60d7aae13bf9abcd0de2e53486c2ed483dfa1060
- SHA512 1203018e5d39636bbb0c28471ff24f971fadbff76fed2b8e66efb93b4e9170471bd09e64bccd63e94bc8b27b513e87a38acb2ab103acf6dbb725d4da11b8365f
- TLSH
  T1C5A002868CCF501189522191E60225D19103D319CEAC0330F0B1220C22058046216B87
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery persistence ransomware upx adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/FixAoFE.exe
- Size 455KB
- SHA256 ee4df57dce754cad85ce1998a1f54990b5ef5dcbd493b6245a600388d08324ae
- MD5 c444c1b5d369cd76d5cc9c2cce7d8dbd
- SHA1 c501b46c3cfffc0ac112d5da4f67e3601bd928e8
- SHA512 6098ca7e8b94a5cf2d03ae8a3dc2d6a6e85d6b1cb6e9fe8caafe8d2f24cad14a097410d82ed733ebaa8ff1c3f2d091be15165092dd65dc738deed0349fca8215
- SSDEEP 12288:HER5VnSNAnnLTeX887paj53fUhVQIC4LmWhactooSE:S/Lq7pahf4k4SIH
- TLSH
  T142A423BD30C4C95EF9C914BBBB0FB0AC05B43D0C1E5482CAAD972B1F6099456EE56EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/Greetz.exe
- Size 159KB
- SHA256 55599e275ac35a5d6bec9838f835b3c363d05d8a0931ea0a3db5cc9a7fd33e28
- MD5 38b9eaee4822af5768f3bf4ac99c1991
- SHA1 53ba4fa4b7367adca014c0b7e234c24ec255e7fa
- SHA512 0f4fd8cfcc25b56b329e98d266ae3681ff1d99261f6fb9ae2a795585666734b46e730701e96e3534e65c387b255d23f7494eca4ef28dbd6b58111d9437671cb8
- SSDEEP 3072:LFgXoMozqVvijyBWljZ36n64NttQl7LngunCJ8ZQf+Kzjf04loS7bZw0:WXfozWB5LtQZpmBf04GS7b
- TLSH
  T1ADF3120B2314E971DF988B7528C2DF650F35CDAA2459CF8FB927DA9D9CF81A30A54C24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/Realms.exe
- Size 3.0MB
- SHA256 338d5bfbb41a2c4dc8a4fcaa103e45e92e23579b69940b32b6761b751f04667c
- MD5 de0e09d50b6f81ca83dfed23eb69b8fc
- SHA1 43f0241fab02464901e3e0c9ede575faf0ce217b
- SHA512 160ba1ff11370aacbcf1b90694ad2a23929a8a687bfa14b76297cb5a212706b664886f4c8f9dab6205d65b74ce82f2ef7f64ab876c81ee5ef466611cf380750a
- SSDEEP 49152:osE6B34HdejEw8pWPGlf2yOD8Dw7fqxvKNRGJvR:osETdRw8xf2yOYDw7faKNRG
- TLSH
  T157E5AF81F64600F1DA52A570105BBF72AFB46B9A0739B6E3F6B8FD250D31392A41F319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/Realms.tbak
- Size 3.0MB
- SHA256 198de762a66e0454a5ece454aa0157b2f78153394f3e0ccf199f871df489666e
- MD5 689a873dbcfbc44345d83b4d5e19306c
- SHA1 be621500890d962e0a432bf98396270619211435
- SHA512 2927d5f4f0b3362632cd6516de99a6439491eb1adf7c3bcec20ed395aad817d756fd9a0e8632e6dcc6ffc9e1adcb9471e94ad2c94de80484f226fc2d37592220
- SSDEEP 49152:osE6B34HdejEw8pWPGlf2yOD8WwxfqxvfNRGJvR:osETdRw8xf2yOYWwxfafNRG
- TLSH
  T100E5AF81F64600F1DA52A570105BBF72AFB46B9A0739B6E3F6B8FD250D31392A41F319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/WTEP.exe
- Size 125KB
- SHA256 f6bcf62632125973c21086ac4c18be73db8e0a9c5a9874bcf5cb9e415717e35e
- MD5 43898ce8956b259dda9aed776dc97498
- SHA1 9ec61f977e95ae3e1408e2dd176e3ee4a4dc0ff8
- SHA512 00ba74feb63bc14cb2edd403ed6954b24c358dc7e8481437984c81b62e235ad6aa0afd5cea72f6551765b8d9a8162bea45fba0c18dbbc15457073ae47c651738
- SSDEEP 1536:z1O+Ab3zdmjvGI/zFZ1xiUIKujsMvidZ/LQdysg2SL:FL9x9m/4xds/SL
- TLSH
  T194C32B46E305CC65D45526F81FB2D79831ED7EB4CBB4DADFB0A0792C1A712C264BA80B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/age.dll
- Size 800KB
- SHA256 e20358bf6c23602f3c0bc5cf1111a9022f49ddb7b748950a3ba3bef8a74267c0
- MD5 ce420d7af507483fdd5523e17bc1fcb4
- SHA1 17e318b2c82b09bbe66d6a648c4b32c34fe04150
- SHA512 87a9bc084e17d10b2f726f4c3243564993fce62a3e725f98ed8a23aeba1414144aedf0f599f3defa618a546bf4c4aea92d50dcdeaa888c1e5fbf8aef46763618
- SSDEEP 12288:DMphttV2Bi6ZOEGI6eNdL+0EuS57evf9:DMrkixBmNdC0EuS578F
- TLSH
  T1F905BFD271BEB033CEAD6034245A0965DD3890C4C95CC97536C4746AABEC2EF067EB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/age2_x1-Paso1.exe
- Size 2.6MB
- SHA256 22b31ac5c8ae40bf9b3586fefd8ddd0e4e0c7c54a9d9dc28b5ef1cf5959df7b1
- MD5 cd9513ee1a34b1474f9aeb55ae629a14
- SHA1 7c6609adb86f115179cd69f206f2bf1b30360166
- SHA512 6f4c600665b12b20cd3518108124b21bd339f1935a50e8423c61e60317fd8e577b9573ea2c93a18fefcbbdaf2837e1035650b09802862f5cc170acb23233efba
- SSDEEP 49152:iNHOUR6ibpzemV+DHbdGpZkFystoIYl9tjkLmUfu:iNuA0nHdQyYl9pkLmUfu
- TLSH
  T1D7C5AF41F58600F1EE556570105FA7729B385BAA0B39B6D3B674FE280E223D2B83F359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/age2_x1.exe
- Size 999KB
- SHA256 a24524566139f37fe0856068fd3779a9d4d50035bd4cca127716f9455b9aca5d
- MD5 82ecea0461158aee5ca79871ad872d98
- SHA1 68ece99fa392c688ef1b9b44c35384159a85fba4
- SHA512 5943a2d2dca17880812bdb999d94bdefcc984407eb559c573453cc911ae4d7c883c404e036bc2726f4c26cb1484583de612699670148c44871b9f99582e0fe42
- SSDEEP 24576:A1J/VjV1V0WDrdNGD+uPKDIQj5DwOTPpVjpOxBMc6o9U2:A13V1VHrd+uIUPpVcBUAU
- TLSH
  T17C2523F1325B8E06E62D4AB1D74ACCD84D4E502A05CBE5BFFD4AB78E08FE9730414499
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  Age Of Empires Kings-Conquerors-Forgotten V2/age2_x1/age2_x1.icd
- Size 2.6MB
- SHA256 447f20a2f8a7cffd7685bc491e7f2ac48b0fa5f3c521a2bf49c1dc6eb30040f7
- MD5 3000d24a49851fd3056bbc22fcfe7a63
- SHA1 ce2e5f1dca297bc0d980ae1cb05df233173497e3
- SHA512 6da367890b5ee40a49372d609f8cede411a7afcbe4a91eeb58744e7d6e780b4b918d0d23ca31100ab83f5ca433a281ccc003ce8b63d1969eee994c8fc9f0cac9
- SSDEEP 49152:/mxkK385cdy4eP881koGsmqgzl+LF8DiEC9jgxLaOfc:/muh54ek81koMlMFkiFjELrfc
- TLSH
  T199C5DE0DB20585B6DE959AF341FF498225A3D9988A6131F2DD1CC20C0F77A83ED6B6F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32