Overview
overview
10Static
static
10冰封免�...m2.dll
windows7-x64
8冰封免�...m2.dll
windows10-2004-x64
8冰封免�...ar.dll
windows7-x64
3冰封免�...ar.dll
windows10-2004-x64
3冰封免�...ll.dll
windows7-x64
1冰封免�...ll.dll
windows10-2004-x64
1冰封免�...fo.dll
windows7-x64
1冰封免�...fo.dll
windows10-2004-x64
3冰封免�...ua.dll
windows7-x64
3冰封免�...ua.dll
windows10-2004-x64
3冰封免�...om.exe
windows7-x64
6冰封免�...om.exe
windows10-2004-x64
6冰封免�...om.dll
windows7-x64
1冰封免�...om.dll
windows10-2004-x64
1冰封免�...jx.dll
windows7-x64
3冰封免�...jx.dll
windows10-2004-x64
1冰封免�...ky.dll
windows7-x64
1冰封免�...ky.dll
windows10-2004-x64
1冰封免�...ty.exe
windows7-x64
5冰封免�...ty.exe
windows10-2004-x64
5冰封免�...ty.dll
windows7-x64
1冰封免�...ty.dll
windows10-2004-x64
1冰封免�...te.exe
windows7-x64
8冰封免�...te.exe
windows10-2004-x64
8冰封免�...ws.dll
windows7-x64
1冰封免�...ws.dll
windows10-2004-x64
1冰封免�...ip.exe
windows7-x64
8冰封免�...ip.exe
windows10-2004-x64
8冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
100s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 18:37
Behavioral task
behavioral1
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win10v2004-20220812-en
General
-
Target
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
-
Size
2.1MB
-
MD5
a9602bea357d9fcb9a8a3b53f18bb56d
-
SHA1
c113487e97340f3ffb4606e37076a629da07caf7
-
SHA256
ed133bdf4f975cacde6078645babcfc22d95f365330a14da02aff106118ebf61
-
SHA512
b88828f0f13afc5e433f839ba44a3d37522c941cdcccb721738a59b849483356954cdc6972c6b27b515344318b3a4e2f43bfcb9fc4e001b797883a66d80c0bfa
-
SSDEEP
49152:H6dL/oKLeBvwHyp6ano1RYsj4Eh5SLiEftPcnP6XM:aBwKq9wSp6FYskEhitt0nP6c
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral28/memory/5060-132-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-167-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral28/memory/5060-183-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral28/memory/5060-176-0x00000000025A0000-0x000000000276D000-memory.dmp vmprotect behavioral28/memory/5060-178-0x00000000025A0000-0x000000000276D000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
冰封vip.exepid process 5060 冰封vip.exe 5060 冰封vip.exe 5060 冰封vip.exe 5060 冰封vip.exe 5060 冰封vip.exe