Analysis
-
max time kernel
97s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 17:07
General
-
Target
豪迪QQ群发7.7 破解版/QS2013.exe
-
Size
2.2MB
-
MD5
327f826191b63c077bbe95ef3dd5f63a
-
SHA1
bec63f9b09f91a4b307ad11619126ace7fe0b18e
-
SHA256
7e13145fdbdc9cdb8f103f1d654ebbd3188d75274b82298990eda1d9a5667ab2
-
SHA512
26b647ec8e8a435565ff914133d459c9aa9c58cfef8fa691025b104f356d01ab7d225c243a196a13a595a95bb4aab1942fd6a2619ee30c918368e59130819699
-
SSDEEP
49152:hDHRzI9C8WN+j65234IPcunLh6X/IwgqGl1WqYQby6WWouFhKUNmRWdiqUbL2Iql:ZHdIMHNgL0udmglGsjUOx
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\QS2013.exe"C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\QS2013.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 5322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3672 -ip 36721⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
64KB
-
Filesize
3.2MB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
1.6MB
-
Filesize
488KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
1024KB
-
Filesize
3.2MB