c2d7bd36651438dc46e8519dcaccff7fbbe838ee3e9b7f875893c7cf9a3493a1

Analysis

max time kernel
33s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hxsyfzgj_56086/YY幻想神域辅助0804/ds30试用版（笔记本小屏幕用）.exe
Size

70KB
MD5

cc886ac7b9ca389cc5ad438b71968055
SHA1

0ba244e6b24b7f4a1775da5ce062c25c205ca9a8
SHA256

87062f6a1b2dd83cd25e71fb9c40c178331cf35d1c4b31d799c2adcd36ae051e
SHA512

964307456ec82608a4c73d2caf2db21bb17ca956acc0001cd5664c180ebaee696f511de2e8f0a4ed467da06833cb09269c7b27385dc9cc8d99f97368544a47a7
SSDEEP

1536:hix4GTf3cAiUz13Wp9626ApvrlVJ4E5s:y4sciz1392rDd4Ms

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	ds30试用版（笔记本小屏幕用）.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe
1760	ds30试用版（笔记本小屏幕用）.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	ds30试用版（笔记本小屏幕用）.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 368	1760	ds30试用版（笔记本小屏幕用）.exe	5
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 380	1760	ds30试用版（笔记本小屏幕用）.exe	4
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 416	1760	ds30试用版（笔记本小屏幕用）.exe	3
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 460	1760	ds30试用版（笔记本小屏幕用）.exe	2
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 476	1760	ds30试用版（笔记本小屏幕用）.exe	1
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 484	1760	ds30试用版（笔记本小屏幕用）.exe	8
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 596	1760	ds30试用版（笔记本小屏幕用）.exe	26
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 672	1760	ds30试用版（笔记本小屏幕用）.exe	25
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 756	1760	ds30试用版（笔记本小屏幕用）.exe	24
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 816	1760	ds30试用版（笔记本小屏幕用）.exe	23
PID 1760 wrote to memory of 856	1760	ds30试用版（笔记本小屏幕用）.exe	22
PID 1760 wrote to memory of 856	1760	ds30试用版（笔记本小屏幕用）.exe	22
PID 1760 wrote to memory of 856	1760	ds30试用版（笔记本小屏幕用）.exe	22
PID 1760 wrote to memory of 856	1760	ds30试用版（笔记本小屏幕用）.exe	22

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1780
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:292
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1140
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1052
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:360
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:880
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2008

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1952

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30试用版（笔记本小屏幕用）.exe
  "C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30试用版（笔记本小屏幕用）.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1760

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1760-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download