Analysis
-
max time kernel
353s -
max time network
441s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 22:24
General
-
Target
rxbaoV3.29_Y/热血宝宝.exe
-
Size
387KB
-
MD5
cfc484f797584ae09ad2b6b2101b84e1
-
SHA1
848be3c4336c3d994020664926ae672cf71d6bcf
-
SHA256
42c7b56ba9fc9abba5457ef1a57b77d7f8ef3709247ab5f236cfc3f98a8ce941
-
SHA512
ea25c9927b45c776b7395432e5caa2b544981a34af38b3a33b0d8da3c34559008bcea3c419988b5d4be7e57c573882bc69f45feeaca2d3c3b1b3a9aa1ae893fb
-
SSDEEP
6144:k7O8fONbOK+4l1oqX0rPUGA4CzsqBqouLVQkqnvzRAdH7JX:k7O5bE4ursGA4Sls3qn7uT
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝.exe"C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\热血宝宝.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/944-54-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/944-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/944-56-0x00000000002B0000-0x00000000002F3000-memory.dmpFilesize
268KB
-
memory/944-58-0x0000000000570000-0x00000000005AB000-memory.dmpFilesize
236KB
-
memory/944-60-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB