Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
26-08-2023 09:51
General
-
Target
酒鬼＊迷失＊100倍充值[0806][云.exe
-
Size
25.6MB
-
MD5
17bceb4da62f4de024b159ded6462d47
-
SHA1
ffbbaaadc0577f8e0d36e3e8ff49dc837a2f5ea9
-
SHA256
db9084b91819dcf7fc10ee6929abcd402dd141fcb64f3d612552c402e8426fa5
-
SHA512
4f95da15d1f547babefe20256e3a5bfd7c83609489e5d0114655fcd39954080dca739471fd8274243bca2013082db0f1c0d97f19dcf16f566996806f972b47f6
-
SSDEEP
393216:21n6+GPJKP3wBit1qPR/lzaxoZONzhJoi6YIhJgZNYlKMYNp6zKy:21nvkJKfwRPkoZShJS/JQNYHYPvy
Malware Config
Signatures
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 26 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\酒鬼＊迷失＊100倍充值[0806][云.exe"C:\Users\Admin\AppData\Local\Temp\酒鬼＊迷失＊100倍充值[0806][云.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\¾Æ¹íÃÔʧ100±¶\酒鬼＊迷失＊100倍充值[0806][云.exeF:\¾Æ¹íÃÔʧ100±¶\酒鬼＊迷失＊100倍充值[0806][云.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\酒鬼＊迷失＊100倍充值[0806][云.exe2⤵
-
F:\¾Æ¹íÃÔʧ100±¶\酒鬼＊迷失＊100倍充值[0806][云.exe"F:\¾Æ¹íÃÔʧ100±¶\酒鬼＊迷失＊100倍充值[0806][云.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD534e6b47cd058255433528a40d0c4c313
SHA101c9a47f2ffd2f67ada51992d05fba88a5ca6422
SHA25676cfa620fe8001a31494fe134130f177a60c61c6c1f52baabee20009cbc650b6
SHA512425412f4af12dcd2d5c1b4fc596e0a0cbb40b4de249f5f5afa1577d79b7afc73fac2ce6cdebb23ecd457a3369b9cf0d75d54efb247b476686e74e3084139f9f7
-
Filesize
25.6MB
MD517bceb4da62f4de024b159ded6462d47
SHA1ffbbaaadc0577f8e0d36e3e8ff49dc837a2f5ea9
SHA256db9084b91819dcf7fc10ee6929abcd402dd141fcb64f3d612552c402e8426fa5
SHA5124f95da15d1f547babefe20256e3a5bfd7c83609489e5d0114655fcd39954080dca739471fd8274243bca2013082db0f1c0d97f19dcf16f566996806f972b47f6
-
Filesize
25.6MB
MD517bceb4da62f4de024b159ded6462d47
SHA1ffbbaaadc0577f8e0d36e3e8ff49dc837a2f5ea9
SHA256db9084b91819dcf7fc10ee6929abcd402dd141fcb64f3d612552c402e8426fa5
SHA5124f95da15d1f547babefe20256e3a5bfd7c83609489e5d0114655fcd39954080dca739471fd8274243bca2013082db0f1c0d97f19dcf16f566996806f972b47f6
-
Filesize
25.6MB
MD517bceb4da62f4de024b159ded6462d47
SHA1ffbbaaadc0577f8e0d36e3e8ff49dc837a2f5ea9
SHA256db9084b91819dcf7fc10ee6929abcd402dd141fcb64f3d612552c402e8426fa5
SHA5124f95da15d1f547babefe20256e3a5bfd7c83609489e5d0114655fcd39954080dca739471fd8274243bca2013082db0f1c0d97f19dcf16f566996806f972b47f6
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB