Analysis
-
max time kernel
171s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
黄金全能计划PK综合版1.5.0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
黄金全能计划PK综合版1.5.0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
黄金全能计划PK综合版1.5.0.exe
-
Size
750KB
-
MD5
4ca022bb94c08f39b432b8bb1834e4b8
-
SHA1
6382af64144446e98f8918b4211c91fac2cab903
-
SHA256
fa86c00725908446692b4e536d6aa3abd5064820c44d6914996ad12441ee2f9e
-
SHA512
7de2df3f189fd305a4294329d3bcceb9f5ebb30eccd9858e4915a38ebc75c2904592e2746d165436214f7ded7ebd1c05f5ea35ca3a9d556a5cdc67884678e87a
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
黄金全能计划PK综合版1.5.0.exedescription ioc process File opened for modification \??\PhysicalDrive0 黄金全能计划PK综合版1.5.0.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
黄金全能计划PK综合版1.5.0.exepid process 3416 黄金全能计划PK综合版1.5.0.exe 3416 黄金全能计划PK综合版1.5.0.exe 3416 黄金全能计划PK综合版1.5.0.exe 3416 黄金全能计划PK综合版1.5.0.exe 3416 黄金全能计划PK综合版1.5.0.exe 3416 黄金全能计划PK综合版1.5.0.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3416-130-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3416-132-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3416-131-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3416-133-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB