bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Submit
Reports

Overview

overview

7

Static

static

1

PvZ_Tools_....3.exe

windows10-2004-x64

1

PvZ_Tools_...xe.asc

windows10-2004-x64

3

PvZ_Tools_...e.hash

windows10-2004-x64

3

PvZ_Tools_...re.dll

windows10-2004-x64

3

PvZ_Tools_...ui.dll

windows10-2004-x64

1

PvZ_Tools_...rk.dll

windows10-2004-x64

3

PvZ_Tools_...ts.dll

windows10-2004-x64

3

PvZ_Tools_...er.dll

windows10-2004-x64

1

PvZ_Tools_...if.dll

windows10-2004-x64

1

PvZ_Tools_...co.dll

windows10-2004-x64

1

PvZ_Tools_...eg.dll

windows10-2004-x64

1

PvZ_Tools_..._1.dll

windows10-2004-x64

3

PvZ_Tools_..._1.dll

windows10-2004-x64

1

PvZ_Tools_...g.json

windows10-2004-x64

3

PvZ_Tools_...ws.dll

windows10-2004-x64

1

PvZ_Tools_...sh.jpg

windows10-2004-x64

3

PvZ_Tools_...le.dll

windows10-2004-x64

1

PvZ_Tools_...86.exe

windows10-2004-x64

7

PvZ_Tools_...b1.dll

windows10-2004-x64

3

PvZ_Tools_...pt.url

windows10-2004-x64

1

PvZ_Tools_...X1.der

windows10-2004-x64

1

PvZ_Tools_...X2.der

windows10-2004-x64

1

PvZ_Tools_...es.url

windows10-2004-x64

1

PvZ_Tools_...it.url

windows10-2004-x64

1

PvZ_Tools_...ds.url

windows10-2004-x64

1

Analysis

max time kernel
261s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Static task

static1

Behavioral task

behavioral1

Sample

PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral2

Sample

PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.asc

Resource

win10v2004-20230220-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral3

Sample

PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.hash

Resource

win10v2004-20230220-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral4

Sample

PvZ_Tools_v2.7.3/Qt5Core.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral5

Sample

PvZ_Tools_v2.7.3/Qt5Gui.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral6

Sample

PvZ_Tools_v2.7.3/Qt5Network.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral7

Sample

PvZ_Tools_v2.7.3/Qt5Widgets.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral8

Sample

PvZ_Tools_v2.7.3/bearer/qgenericbearer.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral9

Sample

PvZ_Tools_v2.7.3/imageformats/qgif.dll

Resource

win10v2004-20230221-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral10

Sample

PvZ_Tools_v2.7.3/imageformats/qico.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral11

Sample

PvZ_Tools_v2.7.3/imageformats/qjpeg.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral12

Sample

PvZ_Tools_v2.7.3/libcrypto-1_1.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral13

Sample

PvZ_Tools_v2.7.3/libssl-1_1.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral14

Sample

PvZ_Tools_v2.7.3/lineup_string.json

Resource

win10v2004-20230221-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral15

Sample

PvZ_Tools_v2.7.3/platforms/qwindows.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral16

Sample

PvZ_Tools_v2.7.3/splash.jpg

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral17

Sample

PvZ_Tools_v2.7.3/styles/qwindowsvistastyle.dll

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral18

Sample

PvZ_Tools_v2.7.3/vc_redist.x86.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral19

Sample

PvZ_Tools_v2.7.3/zlib1.dll

Resource

win10v2004-20230221-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral20

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/Chain of Trust - Let's Encrypt.url

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral21

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X1.der

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral22

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X2.der

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral23

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/下载游戏 Plants vs. Zombies.url

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral24

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/下载辅助 PvZ Toolkit.url

Resource

win10v2004-20230220-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral25

Sample

PvZ_Tools_v2.7.3/植僵工具箱网站/阵型列表 Endless Builds.url

Resource

win10v2004-20230221-en

windows10-2004-x64

0 signatures

300 seconds

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/splash.jpg
Size

182KB
MD5

42df865ebbcd552b23eef7073fd9d09a
SHA1

9d3cfacc387b829f4ffcb15aeeb1f43f208dafa4
SHA256

f9d58c970fce34b9522a54dd03bf56d9cc5e4d3079dba5bfe8708f08bd1c493d
SHA512

299f530136ad1b6887e40eb79d4c98d25c714002ad35e290d93fddc0942c3526138b0fd4eac6ae9f9c1031f4f5dae251810f594347cb83eb2e8d5ba0ccf59678
SSDEEP

3072:HQ8uB+UQ3XlY4K0mTbwgJokD24xWWHS8yXzQjS8hx5Oy7SqedB973jWz0/gSjqpL:wuU8O4U/VJa4JHj2kjt9ZgB9P1M

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Processes

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\splash.jpg
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy