Analysis

  • max time kernel
    111s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 15:04

General

  • Target

    QQ连连看外挂.exe

  • Size

    1.3MB

  • MD5

    bfcbd064d40461622411609ad8290b38

  • SHA1

    5f6d295b3f6b8e2b9be57ea7665fe4537ed0eaee

  • SHA256

    6adf15272b4bd25a06a292569118ce37f22f1eecda32a93cbfdfc14b2e428b01

  • SHA512

    fc7cd845833340eb8da5f1dbb6a6da5a7d51fad29c2cc70d1b683ceda26272c71856065f68850d2d1d71e67a8d09a9847e86e1e68dfe3093bb65b0846fe63feb

  • SSDEEP

    24576:X5YXAz7LyAwqGzYWz5dSBd0ouCvDuE8Dx3TKYGcwnszYKuKGBiykpe4WNJgg:n7WKGzYG5cBKxCLUl3TKYGfszY/KGBGU

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QQ连连看外挂.exe
    "C:\Users\Admin\AppData\Local\Temp\QQ连连看外挂.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1172-54-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1172-55-0x00000000002F0000-0x00000000003E1000-memory.dmp

    Filesize

    964KB

  • memory/1172-58-0x0000000075531000-0x0000000075533000-memory.dmp

    Filesize

    8KB

  • memory/1172-59-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1172-60-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1172-61-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB