ffe2a83d37b7b5657de5c2c2d3fc3db3f4703a0b1a19a9964226eba696040b09 | Triage

Analysis

max time kernel
218s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:02

Sharing

Report Analysis Logs

General

Target

1433_hack44.cn/NB12-18/MD5修改器.exe
Size

772KB
MD5

0f2afa364b5e02702107f085571e3567
SHA1

e00113a6ecca4731a3b762cd81f66c3376f71be4
SHA256

0175b727c7e2eb62461878ce3788616b1cefcfd44f61559924fd6ddbd48c1ec0
SHA512

b03bb984fc80499f07499417d915ddb95bbd28616f49915401435e7b7e1518b1868659c28abbe7cac24cc10e80c1b2883be5343c5fbd4c2e2b6a596f35ae1be1
SSDEEP

24576:69OAfvjaPIxCHjvnpoAbrK2wz4A94Has:causvnpfOiA94Ha

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral20/memory/456-132-0x0000000000400000-0x000000000052D000-memory.dmp	vmprotect
behavioral20/memory/456-133-0x0000000000400000-0x000000000052D000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MD5修改器.exe

pid process

456 MD5修改器.exe
456 MD5修改器.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MD5修改器.exe

pid process

456 MD5修改器.exe
456 MD5修改器.exe

C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\NB12-18\MD5修改器.exe
"C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\NB12-18\MD5修改器.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-132-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/456-133-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download