Analysis
-
max time kernel
69s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12/06/2023, 07:47
General
-
Target
ai进程守护.exe
-
Size
553KB
-
MD5
a3b7a00315b7ff714ea9f2a2660bb5b9
-
SHA1
4a602596a4e176961a132ec87fb1f2bdf8cb5acb
-
SHA256
08960b36601485c4589ad186cc3dea99dfbfe15b40e3d2615747791fdf137674
-
SHA512
47e549d396e047ffa0c8c8b25a5563c9bec1752c090aa829e46dc0679fa621340ab6fd74934a2e9f56a021b4de4638fd47b2f190b4ce02c3f375f35b1a0bebaf
-
SSDEEP
12288:xM04tD6kXMtOJpPh4JIOiXhRdIDIU1Dzoa0pAn:xMxD6kXM4Ph4I7d2H/
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ai进程守护.exe"C:\Users\Admin\AppData\Local\Temp\ai进程守护.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5181⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD5580130429f81a25eeb36c9f0e63925c6
SHA16baaf3130046a3daa36df902ba16b5c2c0354ac3
SHA2569f9e9c9ec201fd805e2f0e2817c8c9a447d301900247e8a80ee65cee14a104ce
SHA5127ae0762029d37abb4002bb2fb2234791b4612119238862f1bb3320eeb41b9d0168385d50b25483ad2dd241d212a36d24fae6a6871ed52414f6ecfece95ef9049
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB