Analysis

  • max time kernel
    100s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 18:37

General

  • Target

    冰封免费版(请关闭杀毒软件下载)/冰封vip.exe

  • Size

    2.1MB

  • MD5

    a9602bea357d9fcb9a8a3b53f18bb56d

  • SHA1

    c113487e97340f3ffb4606e37076a629da07caf7

  • SHA256

    ed133bdf4f975cacde6078645babcfc22d95f365330a14da02aff106118ebf61

  • SHA512

    b88828f0f13afc5e433f839ba44a3d37522c941cdcccb721738a59b849483356954cdc6972c6b27b515344318b3a4e2f43bfcb9fc4e001b797883a66d80c0bfa

  • SSDEEP

    49152:H6dL/oKLeBvwHyp6ano1RYsj4Eh5SLiEftPcnP6XM:aBwKq9wSp6FYskEhitt0nP6c

Score
8/10

Malware Config

Signatures

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\冰封vip.exe
    "C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\冰封vip.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5060-132-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-133-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-134-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-135-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-137-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-139-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-141-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-143-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-145-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-147-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-149-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-153-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-151-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-155-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-157-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-159-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-161-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-165-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-163-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-167-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-169-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-171-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-173-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-175-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/5060-176-0x00000000025A0000-0x000000000276D000-memory.dmp

    Filesize

    1.8MB

  • memory/5060-178-0x00000000025A0000-0x000000000276D000-memory.dmp

    Filesize

    1.8MB

  • memory/5060-182-0x00000000025A0000-0x000000000276D000-memory.dmp

    Filesize

    1.8MB

  • memory/5060-183-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB