Analysis
-
max time kernel
146s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26-11-2022 23:39
General
-
Target
会员终结者3.8.exe
-
Size
1.3MB
-
MD5
c308423474f15a521a02e8f8213ba459
-
SHA1
49c9735a32ce2c3e1e4c7a99e5110f94d0b1a3fd
-
SHA256
3514ebc94c64e6faf1da7c91df9b4d7695bd7717eb34eabde4ee96157abcf4d7
-
SHA512
14ab8fd0e4efc50b1e9b6b8bc9954c3cbeb6eaa37da11c433d73e7a9af162c3e6ec7429d3edf2235a6debac229a7c5c9e930a69c6f0c133646fe5da26b573d59
-
SSDEEP
24576:E7wnMrzYmRa8tH9Vo8QBTQ+WY590c0aRH8fFkj1vzDDST:E3YOtZE+YMaRcfi9O
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\会员终结者3.8.exe"C:\Users\Admin\AppData\Local\Temp\会员终结者3.8.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4320-132-0x0000000000400000-0x00000000007E7000-memory.dmpFilesize
3.9MB
-
memory/4320-133-0x0000000000400000-0x00000000007E7000-memory.dmpFilesize
3.9MB
-
memory/4320-135-0x0000000000400000-0x00000000007E7000-memory.dmpFilesize
3.9MB
-
memory/4320-136-0x0000000000400000-0x00000000007E7000-memory.dmpFilesize
3.9MB