Analysis

  • max time kernel
    107s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 23:34

General

  • Target

    鑫财手机协议全能王/鑫财手机协议全能王.exe

  • Size

    6.0MB

  • MD5

    be542b725a6ff3c449ff3085c8b15851

  • SHA1

    d6c9402e00062b01b47524e9fdd03a797c0c946e

  • SHA256

    43a34a2b39f146348fd47c6ff3b5229dd893f0438d1d3319161768410af6c8ee

  • SHA512

    76a4617bede32e90f4cc516ed6c4e45081ea5b8c88136cff59741c0e48e9fea4084b099cb4252eb7ade346b3a54d8f1539c26a4bfc02fb6cef3c94592cdb5b05

  • SSDEEP

    98304:yneQooD7VL5Ux1cJBAUZL/L4tUvTkfqLdRx9yRmsexACmgYIfzXc:yneQX1o1cJVTL4tUvgfqZYosUnnzM

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\鑫财手机协议全能王.exe
    "C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\鑫财手机协议全能王.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/364-54-0x0000000000400000-0x0000000000A00000-memory.dmp

    Filesize

    6.0MB

  • memory/364-55-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/364-57-0x00000000763B0000-0x00000000763F7000-memory.dmp

    Filesize

    284KB

  • memory/364-464-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-465-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-463-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-466-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-469-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-470-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-468-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-467-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-471-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-472-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-474-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-473-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-476-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-477-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-475-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-481-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-482-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-480-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-479-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-478-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-486-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-487-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-485-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-484-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-483-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-491-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-492-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-490-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-489-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-488-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-495-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-494-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-493-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-499-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-500-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-498-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-497-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-496-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-504-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-505-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-503-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-502-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-501-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-506-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-507-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-509-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-508-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-510-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-511-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-512-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-513-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-515-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-514-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-516-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-519-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-520-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-518-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-517-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-522-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-521-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-524-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-523-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-1369-0x0000000002610000-0x0000000002791000-memory.dmp

    Filesize

    1.5MB

  • memory/364-1367-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/364-4610-0x0000000002470000-0x0000000002581000-memory.dmp

    Filesize

    1.1MB

  • memory/364-4611-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/364-4612-0x0000000002840000-0x0000000002941000-memory.dmp

    Filesize

    1.0MB

  • memory/364-4614-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

  • memory/364-4615-0x0000000002360000-0x0000000002401000-memory.dmp

    Filesize

    644KB

  • memory/364-4616-0x0000000000400000-0x0000000000A00000-memory.dmp

    Filesize

    6.0MB

  • memory/364-4617-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB