Analysis
-
max time kernel
140s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25-11-2022 21:22
General
-
Target
傳奇守護者免费版1.8.9/傲雪残影.exe
-
Size
5.8MB
-
MD5
5fe65f37d4eb3450fc9cd7b815cb105f
-
SHA1
01921e60e2a37b7fe2071b1f821d7820746fa18a
-
SHA256
d06c0348b5240e3ff5b21201a8350461f8afe21be3c4552f726a8a38721784f3
-
SHA512
dbee124db5b972cf6c530b577dc5860491c04b225db75d2c4fa2e8d97c3c660d0b8db6e2722e193626044df234416b171d7630151cac9375bc661489d12f7cbd
-
SSDEEP
98304:DqqAHeF633fbns14Zje8tNJj669cERHEkN+nCF2DpYwaSwIfeaG4u64:DUu2nG488tUdkSCFHQe564
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\傲雪残影.exe"C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\傲雪残影.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/880-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/880-55-0x0000000000400000-0x0000000000A30000-memory.dmpFilesize
6.2MB
-
memory/880-57-0x0000000000400000-0x0000000000A30000-memory.dmpFilesize
6.2MB
-
memory/880-58-0x0000000000400000-0x0000000000A30000-memory.dmpFilesize
6.2MB