Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2023 08:13
Static task
static1
Behavioral task
behavioral1
Sample
diyige.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
diyige.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
diyige.exe
-
Size
1.2MB
-
MD5
64c467cadb010b645ad1a04bb9ae000b
-
SHA1
70b4c4ee4c9fd5c1589140cb0eee13462f01e2bd
-
SHA256
7fcde90bf1f4e6ec55e94000936f6264264990f16511c5fae5a2faaefd8400f7
-
SHA512
9d00aaa855e33264f06075edc021d05c557bf5a01a017c34cd54d2ed2c6c7e1c035374252ac3fad63ccbfc859a3a8e05e7faccb31bc19e2f8aea8bcc2cb6e074
-
SSDEEP
24576:YRXxW6iuh/6+hBbMOr71zBj3qsZw3HKzNf2/nLk/JN4iheo:YRA6iC/hBRv1zBj3q2aqzQ4/JNP
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 diyige.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz diyige.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe 1472 diyige.exe