Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
27-11-2022 13:00
General
-
Target
淘淘淘宝论坛抢沙发软件/淘淘淘宝论坛沙发机.exe
-
Size
1.8MB
-
MD5
b44f2dae79eeffee0174ffa8babb685b
-
SHA1
caf10a193736a58a79e68ea711f46757d85fa0aa
-
SHA256
e320c00f5262fb1cd211af8ae64fdfbb5bd9cc35f125554663f1221c7bcd191e
-
SHA512
3d93e4a23a636b600ef989a290c688cea6b252597b99629f130658a4370d1f8e90792c857cec2a122d38ea5c4706323e957190a244c9df9a70b63fe993a17b34
-
SSDEEP
49152:+TpDJZ0UnBFPDMHWJjtI6DjqdA+zUZZsL:+tJZ0UPPOyjtvqd9U
Score
8/10
Malware Config
Signatures
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\淘淘淘宝论坛抢沙发软件\淘淘淘宝论坛沙发机.exe"C:\Users\Admin\AppData\Local\Temp\淘淘淘宝论坛抢沙发软件\淘淘淘宝论坛沙发机.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
5.0MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
5.0MB
-
Filesize
5.0MB