Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26-11-2022 22:06
General
-
Target
等待YY帐号全自动注册机v3.4.exe
-
Size
1.4MB
-
MD5
9a990a05d06e3bbb67c5cf2652ac8206
-
SHA1
2cac7cb8943a5d7a8c194d2bc1b8ee1c8c48a354
-
SHA256
8a1fed3cf0ef659839dc1520df2e78735036652b691c44b07f8ab572cefd7143
-
SHA512
bc0f9f1c8beba7fef4ba74b698935086ebe139603f2aef48ad19c6c7c6c3f483b39c43cd1e64bde060a95e9235643fad55a2877952a54244dd66b9da923955a3
-
SSDEEP
24576:My5BswmjxTojBXfKrP4Nbko+QY+PCyZUya+CprkybKvS:MyDh06BP049kP+RK4eP
Malware Config
Signatures
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\等待YY帐号全自动注册机v3.4.exe"C:\Users\Admin\AppData\Local\Temp\等待YY帐号全自动注册机v3.4.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5dc9a72042df8c01872be8f95e070113e
SHA16c72d8aa5d5bb78675f358cb669833a10e30f704
SHA256978cf5d25f9255977aa0eb7a3cc5e36873063ee87a9a0ac2a36df2cf80cdee04
SHA5120a0d1d41675cdf240af59434e18ef1f9f020682ab9d2605c055c52563a5026370f6b598747b3c0fc200b8d0afc9a4eecbc1cb9c810e85961d56059c7fe6d0e75
-
Filesize
159KB
MD5ab250ee54abc6c32975a544e9aafd661
SHA1be850caea2e01544ed948b66d62785f4215cb0d8
SHA2568eb01061f3815509a7e5d4d9010ace0e35fdd75597f22bb477e6caac6cd7d7d4
SHA51254a58ccd07191018c3c3f6c06098e59dfe23b5a39347b9252710003e4f4296ff04a8905e05779e0e26b04f448945b2fb5168f1c24a3d250062f81e599db2c399
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.3MB
-
Filesize
3.3MB