Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-01-2023 13:15
Static task
static1
Behavioral task
behavioral1
Sample
免杀捆绑最终完整完美无敌无bug修复版.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
-
Target
免杀捆绑最终完整完美无敌无bug修复版.exe
-
Size
5.1MB
-
MD5
3ba8f05e693a5de1265c7cc24dc623bd
-
SHA1
a0471cf3a6d22e456c3c15a7b56567727351ee66
-
SHA256
0963805830c260ead8299e6f0b441646b6c10f312336d3bcddf2c91441826d16
-
SHA512
72095c76c3de709ec8748aa783826f8103e33f9d9f9b212d81b0562cd441d8994c13b8b75cc065c1bf182326b76a3f51d33a9735e08e6a3a39b35e41f4fc9242
-
SSDEEP
98304:XWUZkF4qCYg1XyKztb0xZTASC1qvfnUScZxWDMK6UeFLOAkGkzdnEVomFHKnPn6:GU+0YECwmfnUSEUeFLOyomFHKnP6
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~4.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RE78D9~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\ADOBEL~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSIG~1.PDF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MYRIAD~1.OTF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~2.GIF cmd.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\server\classes.jsa cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\CRYPTO~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\LOGTRA~1.EXE cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\LOGSES~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ADD_RE~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\STOP_C~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\ADOBEU~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SERVER~2.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\END_RE~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~3.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNOF~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif cmd.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\EMAIL_~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\OPEN_O~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RECDE7~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\CREATE~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~2.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SERVER~3.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPU~1.INI cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RE1558~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\CRYPTO~1.SIG cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\LICENS~1.HTM cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SERVER~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORM_R~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNOF~2.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\CCME_B~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~3.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNON~2.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNON~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\IDENTI~1 cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\STANDA~1.PDF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\DISTRI~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SUBMIS~1.GIF cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SH~1.DLL cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif cmd.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RE99D5~1.GIF cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 1928 免杀捆绑最终完整完美无敌无bug修复版.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 免杀捆绑最终完整完美无敌无bug修复版.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2012 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 27 PID 1928 wrote to memory of 2012 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 27 PID 1928 wrote to memory of 2012 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 27 PID 1928 wrote to memory of 2012 1928 免杀捆绑最终完整完美无敌无bug修复版.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\免杀捆绑最终完整完美无敌无bug修复版.exe"C:\Users\Admin\AppData\Local\Temp\免杀捆绑最终完整完美无敌无bug修复版.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del /f /s /q c:\2⤵
- Drops file in Program Files directory
PID:2012
-