Analysis
-
max time kernel
241s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
26/11/2022, 22:35
General
-
Target
游蚊传奇.exe
-
Size
5.9MB
-
MD5
e817a8fa456e87fcd90233433ffd8b9f
-
SHA1
42d83701caee3e91b71f693d2f56f7b54aa542a4
-
SHA256
4f664dac65ee7614d66135e4a1fb1b19930288cb0f80d32ac64dd417e47f5d60
-
SHA512
47f5a4c440c051334ca0cce3f2d4e6e067644e9f4d89ee48ce11869b5cec6decbb5cf2424e103cbd4767e85c4b072c319d3499c5bf6e3bbe0697220ce08cd409
-
SSDEEP
98304:9/X41pMwpaSwIfeaG4u6LZje8tNJj669cERHEkN+nCFlWFf9kSIiLA:J4pMwMQe56L88tUdkSCFK1k
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\游蚊传奇.exe"C:\Users\Admin\AppData\Local\Temp\游蚊传奇.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
6.2MB
-
Filesize
6.2MB