Overview
overview
7Static
static
1PvZ_Tools_....3.exe
windows10-2004-x64
1PvZ_Tools_...xe.asc
windows10-2004-x64
3PvZ_Tools_...e.hash
windows10-2004-x64
3PvZ_Tools_...re.dll
windows10-2004-x64
3PvZ_Tools_...ui.dll
windows10-2004-x64
1PvZ_Tools_...rk.dll
windows10-2004-x64
3PvZ_Tools_...ts.dll
windows10-2004-x64
3PvZ_Tools_...er.dll
windows10-2004-x64
1PvZ_Tools_...if.dll
windows10-2004-x64
1PvZ_Tools_...co.dll
windows10-2004-x64
1PvZ_Tools_...eg.dll
windows10-2004-x64
1PvZ_Tools_..._1.dll
windows10-2004-x64
3PvZ_Tools_..._1.dll
windows10-2004-x64
1PvZ_Tools_...g.json
windows10-2004-x64
3PvZ_Tools_...ws.dll
windows10-2004-x64
1PvZ_Tools_...sh.jpg
windows10-2004-x64
3PvZ_Tools_...le.dll
windows10-2004-x64
1PvZ_Tools_...86.exe
windows10-2004-x64
7PvZ_Tools_...b1.dll
windows10-2004-x64
3PvZ_Tools_...pt.url
windows10-2004-x64
1PvZ_Tools_...X1.der
windows10-2004-x64
1PvZ_Tools_...X2.der
windows10-2004-x64
1PvZ_Tools_...es.url
windows10-2004-x64
1PvZ_Tools_...it.url
windows10-2004-x64
1PvZ_Tools_...ds.url
windows10-2004-x64
1Analysis
-
max time kernel
261s -
max time network
265s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.asc
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.hash
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
PvZ_Tools_v2.7.3/Qt5Core.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
PvZ_Tools_v2.7.3/Qt5Gui.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
PvZ_Tools_v2.7.3/Qt5Network.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
PvZ_Tools_v2.7.3/Qt5Widgets.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
PvZ_Tools_v2.7.3/bearer/qgenericbearer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
PvZ_Tools_v2.7.3/imageformats/qgif.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
PvZ_Tools_v2.7.3/imageformats/qico.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
PvZ_Tools_v2.7.3/imageformats/qjpeg.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
PvZ_Tools_v2.7.3/libcrypto-1_1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
PvZ_Tools_v2.7.3/libssl-1_1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
PvZ_Tools_v2.7.3/lineup_string.json
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
PvZ_Tools_v2.7.3/platforms/qwindows.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
PvZ_Tools_v2.7.3/splash.jpg
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
PvZ_Tools_v2.7.3/styles/qwindowsvistastyle.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
PvZ_Tools_v2.7.3/vc_redist.x86.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
PvZ_Tools_v2.7.3/zlib1.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/Chain of Trust - Let's Encrypt.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X1.der
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/HTTPS 根证书/ISRG Root X2.der
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/下载游戏 Plants vs. Zombies.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/下载辅助 PvZ Toolkit.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
PvZ_Tools_v2.7.3/植僵工具箱网站/阵型列表 Endless Builds.url
Resource
win10v2004-20230221-en
General
-
Target
PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.asc
-
Size
833B
-
MD5
b79918d721f70fd14069e2aba5678d05
-
SHA1
42cca4d5a32341415198ad8e9ed89da9d6d0321e
-
SHA256
7c533f49568d6b9f9d4389c2eb9a13f9306a5fbe77778f9fa8ffdbec3f4712b3
-
SHA512
3f328b420c1318c3f7f207b2995481fcf15756977e38b7df95dc36c6be067b4970309112193d1275a9a0430e0464f7902657b4f2031c2076ae9738577f6ba3b5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3612 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\PvZ_Tools_v2.7.3.exe.asc1⤵
- Modifies registry class
PID:2276
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3612