26f4c8737102d981ec46fc892ab726dcaf4c8ad3c84602680c52601738a74e5a | Triage

Analysis

max time kernel
130s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 19:27

Sharing

Report Analysis Logs

General

Target

创建所有数据更新包.exe
Size

28KB
MD5

54c1be58fa540a4b72b092ece85a97ee
SHA1

6843bc6cc65fc6c3a5e4524a921f7ff93d408a32
SHA256

26f4c8737102d981ec46fc892ab726dcaf4c8ad3c84602680c52601738a74e5a
SHA512

8ffdc2980d9cf1bf5b3e5d336ed5efa414696952ed355bd36b785c0d08ac49cac6b8b403d36b926cf0aec68fb7c60dd58a9fe441904d1b7227cbee5f18c7f68e
SSDEEP

384:Mp7jP9tP2VRrTsklOuQBcBa5Xg+yIGhKv7QMvI96ua96uoGy+6B5gqz5dt69Zuxj:+tktIiKsx+6/9JVHDrT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1636	创建所有数据更新包.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
956	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	创建所有数据更新包.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 956	1636	创建所有数据更新包.exe	27
PID 1636 wrote to memory of 956	1636	创建所有数据更新包.exe	27
PID 1636 wrote to memory of 956	1636	创建所有数据更新包.exe	27

C:\Users\Admin\AppData\Local\Temp\创建所有数据更新包.exe
"C:\Users\Admin\AppData\Local\Temp\创建所有数据更新包.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 468
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-56-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1636-54-0x0000000001120000-0x000000000112C000-memory.dmp

Filesize
48KB

Download
memory/1636-55-0x00000000005B0000-0x0000000000630000-memory.dmp

Filesize
512KB

Download
memory/1636-57-0x00000000005B0000-0x0000000000630000-memory.dmp

Filesize
512KB

Download