Analysis
-
max time kernel
155s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
当下软件园.url
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
当下软件园.url
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
绿叶9.11免费版.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
绿叶9.11免费版.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
绿叶9.11免费版.exe
-
Size
3.8MB
-
MD5
4fa0b33968033f657167c49f0a4e3417
-
SHA1
61a39325bf5820aa947fc5adf63d3830c50da789
-
SHA256
6ceb97211d8c6c8ee28cb0d814c6036ac343b3c99f4839d509fafb696a7b5ed9
-
SHA512
3a22762adb5cf87c167538d712bbb47ecb6511e4d080214e37eeb62f87a999eb447f2a36237609ff6da946c794db2181c617863ae50578b87964f5952944f3f0
-
SSDEEP
98304:GWxDvMsT0njMTwVQ5WwF+qs62QYbsB3Xm7G24ZF3TlbJBAUZLtK8+:btvMsTugTwVQ5WwUGBXTlbJVxq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 绿叶9.11免费版.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 绿叶9.11免费版.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 绿叶9.11免费版.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync 绿叶9.11免费版.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe 1108 绿叶9.11免费版.exe