Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
19-07-2023 09:50
General
-
Target
启动器5.exe
-
Size
8.6MB
-
MD5
427a6f4998a86ac166094df773204e15
-
SHA1
4f9d98837fdb519051c990dbd722f95cd53bb3d0
-
SHA256
1533629ea7819e0cc5ae30ebd3a3ed467c56ff6e67b4a973832bc1a90e94c92d
-
SHA512
b4b368904d3b6d4fd6ce2955f38044f55f9f7e98419b91f073c992d1e6e4d84da2daae1a1216cedb95a21e43360421d5ff8232da02c4d5002b639e4335312d62
-
SSDEEP
98304:/r3frjoeEg5qcAd4p5BlmkC+/C4OWoHI7NINa4tqR+zqbJ278QnV4jEMSD6BXlkz:/7frMM5qr4FlmIdCIetOl27qEMSOsJ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\启动器5.exe"C:\Users\Admin\AppData\Local\Temp\启动器5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56a004b4196400a627b5b6248a2a2dcba
SHA1fa9a555e83a4c3a73e07a728ec92827f55fbcf02
SHA2569cd3e3f97866082f8edfed25d56b40786c2809f264c4f8b10c022403e7f0f101
SHA5121b5cea41dce0742e4ba7a7f3c4bef3eefc92c63d267a306e4098c68b768723abc0f0eace4a486ff3f4b1bb8a74279dd04e9c2a48df9a20125c21209e3d205624
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB