Analysis
-
max time kernel
140s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2023 11:57
Behavioral task
behavioral1
Sample
专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]
Resource
win10v2004-20230221-en
General
-
Target
专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]
-
Size
893KB
-
MD5
68d5159d32321ed664a26fa01def4b5b
-
SHA1
c34bb6c6bb1dcac3be26e4a09daf77166394a62f
-
SHA256
a073bbd15699f1ee32b8a22830d9f37780c4352af7e17054a8d665f70b66df1b
-
SHA512
61084abaf021201ed0048311f83042a7f0ce6fbecebf6f3fb8cb6b0978e471dff0087a12b6e28dca63bd3c801a35183bc90bdbd35c24fd1c5802996f010bbc15
-
SSDEEP
24576:f2T9aWflilx1hcv70Tf109RZC20CoY7ZWlhKbjDwNDisiTopC4dz:fI9nflidl1yu2gY7ZW6bjDwNDisisp1F
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1340-54-0x0000000010000000-0x000000001008B000-memory.dmp upx behavioral1/memory/1340-57-0x0000000010000000-0x000000001008B000-memory.dmp upx behavioral1/memory/1340-58-0x0000000010000000-0x000000001008B000-memory.dmp upx behavioral1/memory/1340-59-0x0000000010000000-0x000000001008B000-memory.dmp upx behavioral1/memory/1340-60-0x0000000000400000-0x00000000005F2000-memory.dmp upx behavioral1/memory/1340-63-0x0000000000400000-0x00000000005F2000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]pid process 1340 专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected] 1340 专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected] -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]pid process 1340 专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]"C:\Users\Admin\AppData\Local\Temp\专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-54-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB
-
memory/1340-57-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB
-
memory/1340-58-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB
-
memory/1340-59-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB
-
memory/1340-60-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/1340-61-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1340-62-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1340-63-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/1340-64-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB