778ee9eed18d79a8344aeaa35726075c889bb391599977ee9787162465e23c4a

General

Target

疯狂神器2014-终极版.exe
Size

17.0MB
MD5

499936e83f5bb80424439f40684a35ce
SHA1

4edc7a2d493270c6fb82b9aeb7504b59d8ab2996
SHA256

4a591f9699af60ad1fdf47817ef11cbd01a4da1307e076358ec94335867d441f
SHA512

6b5c8532701729eb1242642fb8819f3cfcb105e2dd27d5f8c7654afca952ce9ff58db9badf76ec514ad01d426a55c002f34237d6e6b9c9acb06cecc6348a383c
SSDEEP

196608:EX5kL227Kf97ZY2XnAF4EEqkvxLrqGns07QNSREQces8+JHnxXCjyE9Mee6ChJ1T:E5QVWXKCvxLrqGniVQ2XOevxt7rX7

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1832-55-0x0000000000400000-0x0000000002880000-memory.dmp	vmprotect
behavioral1/memory/1832-56-0x0000000000400000-0x0000000002880000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

疯狂神器2014-终极版.exe

pid process

1832 疯狂神器2014-终极版.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

疯狂神器2014-终极版.exe

pid	process
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe
1832	疯狂神器2014-终极版.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

疯狂神器2014-终极版.exe

description pid process

Token: SeDebugPrivilege 1832 疯狂神器2014-终极版.exe

description	pid	process
Token: SeDebugPrivilege	1832	疯狂神器2014-终极版.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

疯狂神器2014-终极版.exe

description	pid	process	target process
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 368	1832	疯狂神器2014-终极版.exe	wininit.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 384	1832	疯狂神器2014-终极版.exe	csrss.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 420	1832	疯狂神器2014-终极版.exe	winlogon.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 464	1832	疯狂神器2014-终极版.exe	services.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 480	1832	疯狂神器2014-终极版.exe	lsass.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 488	1832	疯狂神器2014-终极版.exe	lsm.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 604	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 680	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 752	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 812	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 836	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 836	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 836	1832	疯狂神器2014-终极版.exe	svchost.exe
PID 1832 wrote to memory of 836	1832	疯狂神器2014-终极版.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:604

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1804

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1136

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\疯狂神器2014-终极版.exe
"C:\Users\Admin\AppData\Local\Temp\疯狂神器2014-终极版.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1832-55-0x0000000000400000-0x0000000002880000-memory.dmp

Filesize
36.5MB

Download
memory/1832-56-0x0000000000400000-0x0000000002880000-memory.dmp

Filesize
36.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads