Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 05:04
Behavioral task
behavioral1
Sample
jiejsgsbfz/神兵3.3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jiejsgsbfz/神兵3.3.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
使用必读.url
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
使用必读.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
流行软件园-绿色软件下载站,绿色软件免费下载联盟.url
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
流行软件园-绿色软件下载站,绿色软件免费下载联盟.url
Resource
win10v2004-20220812-en
General
-
Target
jiejsgsbfz/神兵3.3.exe
-
Size
7.3MB
-
MD5
0a9b93408c5ba5cdb529ff5e6e675c57
-
SHA1
0fcf6325045048deeb16c866b4ca5a40283f9c6c
-
SHA256
121c13e79b29689025903d57eb0806f91b3f215ead187f8bd470b26d1061a59c
-
SHA512
0f73dabb41e6333bfa547568c8622b5f15772fd6d52fa174cd4da4d42ef5db61e691629e7ee987d14d54d4b915f8af204a4aa63855651ecf44881681417d18ab
-
SSDEEP
196608:siE8Hm2ZWmzmhy8Cnlgyl6oa5iPisdqGfzXj:oUm5amIznV054iIfz
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1980-59-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-60-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-63-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-65-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-69-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-73-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-75-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-77-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-79-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-83-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-87-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-89-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-91-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-93-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-97-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-99-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-101-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-95-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-85-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-81-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-71-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-67-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-61-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx behavioral1/memory/1980-102-0x0000000002B50000-0x0000000002B8E000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/1980-54-0x0000000000400000-0x0000000001318000-memory.dmp vmprotect behavioral1/memory/1980-56-0x0000000000400000-0x0000000001318000-memory.dmp vmprotect behavioral1/memory/1980-103-0x0000000000400000-0x0000000001318000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
神兵3.3.exedescription ioc process File opened for modification \??\PhysicalDrive0 神兵3.3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
神兵3.3.exepid process 1980 神兵3.3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
神兵3.3.exepid process 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
神兵3.3.exepid process 1980 神兵3.3.exe 1980 神兵3.3.exe 1980 神兵3.3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jiejsgsbfz\神兵3.3.exe"C:\Users\Admin\AppData\Local\Temp\jiejsgsbfz\神兵3.3.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1980
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1980-54-0x0000000000400000-0x0000000001318000-memory.dmpFilesize
15.1MB
-
memory/1980-55-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1980-56-0x0000000000400000-0x0000000001318000-memory.dmpFilesize
15.1MB
-
memory/1980-59-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-60-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-63-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-65-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-69-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-73-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-75-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-77-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-79-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-83-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-87-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-89-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-91-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-93-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-97-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-99-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-101-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-95-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-85-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-81-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-71-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-67-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-61-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-102-0x0000000002B50000-0x0000000002B8E000-memory.dmpFilesize
248KB
-
memory/1980-103-0x0000000000400000-0x0000000001318000-memory.dmpFilesize
15.1MB