Analysis
-
max time kernel
62s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
黄金全能计划PK综合版1.5.0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
黄金全能计划PK综合版1.5.0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
黄金全能计划PK综合版1.5.0.exe
-
Size
750KB
-
MD5
4ca022bb94c08f39b432b8bb1834e4b8
-
SHA1
6382af64144446e98f8918b4211c91fac2cab903
-
SHA256
fa86c00725908446692b4e536d6aa3abd5064820c44d6914996ad12441ee2f9e
-
SHA512
7de2df3f189fd305a4294329d3bcceb9f5ebb30eccd9858e4915a38ebc75c2904592e2746d165436214f7ded7ebd1c05f5ea35ca3a9d556a5cdc67884678e87a
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
黄金全能计划PK综合版1.5.0.exedescription ioc process File opened for modification \??\PhysicalDrive0 黄金全能计划PK综合版1.5.0.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
黄金全能计划PK综合版1.5.0.exepid process 1120 黄金全能计划PK综合版1.5.0.exe 1120 黄金全能计划PK综合版1.5.0.exe 1120 黄金全能计划PK综合版1.5.0.exe 1120 黄金全能计划PK综合版1.5.0.exe 1120 黄金全能计划PK综合版1.5.0.exe 1120 黄金全能计划PK综合版1.5.0.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1120-54-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1120-55-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1120-57-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1120-56-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1120-58-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB