| File name: | HollowKnight.exe |
| Full analysis: | https://app.any.run/tasks/9451dd5a-259a-4912-8e4c-5d8775d6d8df |
| Verdict: | Malicious activity |
| Analysis date: | February 13, 2024, 17:09:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 1F7AE217A85ABF6806F7D601E53A98B1 |
| SHA1: | 4B5323EEF554E916628DFCF297B974E32B057FBD |
| SHA256: | 8E649261E73E3C9A0A0DC9D245B76A631D39A44EA8A70195ACE2E8A1B6103DF5 |
| SSDEEP: | 12288:fU5xeBzkvWXso6L3R7d4M4IqxCRytM+6atgvJzk6/QiMnxig:fU5xeBzkvWXso6L3RZqIqxCRytzngvGZ |
MALICIOUS
Drops the executable file immediately after the start
- HollowKnight.exe (PID: 3660)
- cmd.exe (PID: 2848)
Changes image file execution options
- reg.exe (PID: 3948)
- reg.exe (PID: 2332)
- reg.exe (PID: 2328)
- reg.exe (PID: 3932)
- reg.exe (PID: 2636)
- reg.exe (PID: 3212)
- reg.exe (PID: 120)
- reg.exe (PID: 2124)
- reg.exe (PID: 3936)
- reg.exe (PID: 1696)
- reg.exe (PID: 2648)
UAC/LUA settings modification
- reg.exe (PID: 3996)
Antivirus name has been found in the command line (generic signature)
- reg.exe (PID: 3212)
- reg.exe (PID: 2636)
Starts NET.EXE to view/add/change user profiles
- cmd.exe (PID: 2848)
- net.exe (PID: 2856)
Create files in the Startup directory
- cmd.exe (PID: 2848)
SUSPICIOUS
Process drops legitimate windows executable
- HollowKnight.exe (PID: 3660)
- cmd.exe (PID: 2848)
Executable content was dropped or overwritten
- HollowKnight.exe (PID: 3660)
- cmd.exe (PID: 2848)
Reads security settings of Internet Explorer
- HollowKnight.exe (PID: 3660)
The process creates files with name similar to system file names
- HollowKnight.exe (PID: 3660)
Executing commands from a ".bat" file
- HollowKnight.exe (PID: 3660)
Starts CMD.EXE for commands execution
- HollowKnight.exe (PID: 3660)
Reads the Internet Settings
- HollowKnight.exe (PID: 3660)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 2848)
Get information on the list of running processes
- cmd.exe (PID: 2848)
INFO
Create files in a temporary directory
- HollowKnight.exe (PID: 3660)
Checks supported languages
- HollowKnight.exe (PID: 3660)
- wmpnscfg.exe (PID: 2644)
Reads the computer name
- HollowKnight.exe (PID: 3660)
- wmpnscfg.exe (PID: 2644)
Creates files in the program directory
- cmd.exe (PID: 2848)
Reads the time zone
- net1.exe (PID: 3276)
Manual execution by a user
- wmpnscfg.exe (PID: 2644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (64.1) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.5) |
| .exe | | | Win32 Executable (generic) (10.6) |
| .exe | | | Generic Win/DOS Executable (4.7) |
| .exe | | | DOS Executable Generic (4.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:07:30 08:52:50+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.5 |
| CodeSize: | 135168 |
| InitializedDataSize: | 274432 |
| UninitializedDataSize: | 339968 |
| EntryPoint: | 0x73d80 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.5.68.11808 |
| ProductVersionNumber: | 1.5.68.11808 |
| FileFlagsMask: | 0x003f |
| FileFlags: | Debug, Pre-release, Private build |
| FileOS: | Windows 16-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| FileVersion: | 1.5.68.11808 |
| ProductVersion: | 1.5.68.11808 |
| ProductName: | Hollow Knight |
| OriginalFileName: | HollowKnight.exe |
| FileDescription: | Hollow Knight Web Setup |
| CompanyName: | Team Cherry |
| LegalTrademarks: | Hollow Knight |
| LegalCopyright: | (c) Team Cherry |
Total processes
59
Monitored processes
20
Malicious processes
2
Suspicious processes
11
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_SZ /d 1 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 120 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1696 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2124 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zFM.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2328 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2332 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2408 | reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2636 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2644 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2648 | reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe" /v "Debugger" /t REG_SZ /d C:\ProgramData\winlogon.exe /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
725
Read events
703
Write events
22
Delete events
0
Modification events
| (PID) Process: | (3660) HollowKnight.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3660) HollowKnight.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3660) HollowKnight.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3660) HollowKnight.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3948) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
| (PID) Process: | (3932) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
| (PID) Process: | (2332) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
| (PID) Process: | (2328) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
| (PID) Process: | (2636) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
| (PID) Process: | (3212) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe |
| Operation: | write | Name: | Debugger |
Value: C:\ProgramData\winlogon.exe | |||
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2848 | cmd.exe | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\MSASCui.exe | executable | |
MD5:A806127E04399CDBBFA8A385AE8E7D30 | SHA256:DA5BC97F9AE526F8121D61E3D6FA3EEE4E885F0D92B020B8078D517FF599A1B9 | |||
| 3660 | HollowKnight.exe | C:\Users\admin\AppData\Local\Temp\F1E2.tmp\F1E3.tmp\F1E4.bat | text | |
MD5:B32A03FEB18B092F04705DD716767A12 | SHA256:9A4ADBE00E6B804778ACD1C7AF9BEE680A766337CD352EC751082ED5123263E3 | |||
| 3660 | HollowKnight.exe | C:\Users\admin\AppData\Local\Temp\F1E2.tmp\system.exe | executable | |
MD5:A806127E04399CDBBFA8A385AE8E7D30 | SHA256:DA5BC97F9AE526F8121D61E3D6FA3EEE4E885F0D92B020B8078D517FF599A1B9 | |||
| 3660 | HollowKnight.exe | C:\Users\admin\AppData\Local\Temp\F1E2.tmp\restrictions.exe | executable | |
MD5:6D4AFFF33BAD1A8D425D01738B126276 | SHA256:0B1AE37E8FDE0C713641A0C867C4294BA3BD3907ADA70FE9687D84C6E355F02D | |||
| 2848 | cmd.exe | C:\ProgramData\winlogon.exe | executable | |
MD5:6D4AFFF33BAD1A8D425D01738B126276 | SHA256:0B1AE37E8FDE0C713641A0C867C4294BA3BD3907ADA70FE9687D84C6E355F02D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |