16cd981da3094abae4b294c8861beffbe7b4ddd1c6eeed42858dc6c386a8f22d | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:39

Sharing

Report Analysis Logs

General

Target

手机QQ挂号器/手机QQ挂号器.exe
Size

2.0MB
MD5

39455cce9adc567adbd66f8061f9ef14
SHA1

f69920acae91fbb9649a5968d8592293bbe9f307
SHA256

b3250b0fd2618d16d08a5da03cf14678ee72596c9f8979237e50f94760ad403d
SHA512

7bbc19dc00a0401dee347175e72a5190e3b5234f04b2fc699955e5ce29b4a6bff1db673a0cf8aabe77e1c1b48fe1df0751b59073e7ec825b642251d25409a5e2
SSDEEP

49152:cjks4OnC/bejYsmt+s8KuqGaX0ToIBAUZLYN:AdnEsmGJBAUZLe

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	手机QQ挂号器.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1768	手机QQ挂号器.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1768	手机QQ挂号器.exe
1768	手机QQ挂号器.exe

C:\Users\Admin\AppData\Local\Temp\手机QQ挂号器\手机QQ挂号器.exe
"C:\Users\Admin\AppData\Local\Temp\手机QQ挂号器\手机QQ挂号器.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download