5b82da42d8bf90a9b1796f2e36b6f2b486f30c8dd7b83bda19cdb4cd354fb04f | Triage

Analysis

max time kernel
164s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:35

Sharing

Report Analysis Logs

General

Target

游蚊传奇.exe
Size

5.9MB
MD5

e817a8fa456e87fcd90233433ffd8b9f
SHA1

42d83701caee3e91b71f693d2f56f7b54aa542a4
SHA256

4f664dac65ee7614d66135e4a1fb1b19930288cb0f80d32ac64dd417e47f5d60
SHA512

47f5a4c440c051334ca0cce3f2d4e6e067644e9f4d89ee48ce11869b5cec6decbb5cf2424e103cbd4767e85c4b072c319d3499c5bf6e3bbe0697220ce08cd409
SSDEEP

98304:9/X41pMwpaSwIfeaG4u6LZje8tNJj669cERHEkN+nCFlWFf9kSIiLA:J4pMwMQe56L88tUdkSCFK1k

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4220	5004	WerFault.exe	80
1712	5004	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5004	游蚊传奇.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	游蚊传奇.exe
5004	游蚊传奇.exe

C:\Users\Admin\AppData\Local\Temp\游蚊传奇.exe
"C:\Users\Admin\AppData\Local\Temp\游蚊传奇.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 868
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 820
  2⤵
  - Program crash
  PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5004 -ip 5004
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5004 -ip 5004
1⤵
PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-132-0x0000000000400000-0x0000000000A30000-memory.dmp

Filesize
6.2MB

Download
memory/5004-133-0x0000000000400000-0x0000000000A30000-memory.dmp

Filesize
6.2MB

Download