Analysis
-
max time kernel
117s -
max time network
175s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 07:05
General
-
Target
2名高三女学生酒吧被下药，被带到酒店进行疯狂性虐待、各种姿势爆操视频.exe
-
Size
2.1MB
-
MD5
a8a2233b38793d77203a29fee7288bc8
-
SHA1
bab33409a0ae5b3a203d2c07a1294a086e65444b
-
SHA256
8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58
-
SHA512
cfa6f107e5c666dfb418bf0275f80b17c0ed696fcfa121a743d4a743f3282fe41623a4cffc2652a4260aaf87763823a56028b6953f5fb80c249c0af616a36c8a
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2名高三女学生酒吧被下药，被带到酒店进行疯狂性虐待、各种姿势爆操视频.exe"C:\Users\Admin\AppData\Local\Temp\2名高三女学生酒吧被下药，被带到酒店进行疯狂性虐待、各种姿势爆操视频.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB