Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30-08-2022 15:02
General
-
Target
修改器/游戏.电影菜单.exe
-
Size
4.3MB
-
MD5
723fac5412b21bd330f029f25394940f
-
SHA1
518448403cbdc762981d04c1267f95cf1f3a7c81
-
SHA256
e4b04016d16b94c4822d501ccce906c2119bfe7f535b15985eb070af2aef6cf6
-
SHA512
54ca7b4fd23d5e2a6c23828aa54eac52f4931f94ecf4acd387e12917142287305035752d227e3cf746489fef9332e18437427b7efc667ce919d66fea95ae8af0
-
SSDEEP
98304:N8XJC/xyLVUuzA2aJQd2zd5KseDtdD6Pq9L9vnoPGWzC+2vIHD:NUJC2VUcamUpMT6yL9voPGCCLY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\修改器\游戏.电影菜单.exe"C:\Users\Admin\AppData\Local\Temp\修改器\游戏.电影菜单.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QL73Q.tmp\游戏.电影菜单.tmp"C:\Users\Admin\AppData\Local\Temp\is-QL73Q.tmp\游戏.电影菜单.tmp" /SL5="$8005A,4060808,153088,C:\Users\Admin\AppData\Local\Temp\修改器\游戏.电影菜单.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\修改器\Games.exe"C:\Users\Admin\AppData\Local\Temp\修改器\Games.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f0c35c57e05395958aef0812955f36cd
SHA15e64b5e29f84e00cfbb8eb20a213fbfd8e6efc5b
SHA256564c1ba7f298bebeb0cd299f0d157816f5ee4fa0fcd85ad8478f6b0ce6ee5e32
SHA512f7b7f7999cd659ea011ddd18e73068d7fb444f6e559aaf568f4d252033980e0b7ab9e2f10a028d763f62035aad816391e26910fd446a7c1d80db23288555118f
-
Filesize
1.5MB
MD5f0c35c57e05395958aef0812955f36cd
SHA15e64b5e29f84e00cfbb8eb20a213fbfd8e6efc5b
SHA256564c1ba7f298bebeb0cd299f0d157816f5ee4fa0fcd85ad8478f6b0ce6ee5e32
SHA512f7b7f7999cd659ea011ddd18e73068d7fb444f6e559aaf568f4d252033980e0b7ab9e2f10a028d763f62035aad816391e26910fd446a7c1d80db23288555118f
-
Filesize
18.7MB
MD5ec4fa2304daf43d2230c85ec365f58c7
SHA10adffbbd3e7f0dbd3dccdd6c6ab6365c74ec972b
SHA256ac8bb80c4e75c03dfbaab50f00f5e921affc3e28636755f95dc37b538f4c9628
SHA51279bcd6ce4da5864d496e85d1c3c87b2986489b20631a183fb4f915e4345fd9fa1025ad9d53dd94bce11f3ac4154f4283a7783ae7423390baa0789859fb285331
-
Filesize
18.7MB
MD5ec4fa2304daf43d2230c85ec365f58c7
SHA10adffbbd3e7f0dbd3dccdd6c6ab6365c74ec972b
SHA256ac8bb80c4e75c03dfbaab50f00f5e921affc3e28636755f95dc37b538f4c9628
SHA51279bcd6ce4da5864d496e85d1c3c87b2986489b20631a183fb4f915e4345fd9fa1025ad9d53dd94bce11f3ac4154f4283a7783ae7423390baa0789859fb285331
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
18.8MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
1.5MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
32KB