Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 03:28
General
-
Target
办公室游戏助手v2.3.exe
-
Size
1.8MB
-
MD5
fdfb4890f88432496609922096e9d9a4
-
SHA1
5748b55a0d1c6dc71ccb975fe900eaafb9de5dc0
-
SHA256
330236e4a8feb1040db15771250e743a90cbfcf9b995573ca78c898ef8f7e0c7
-
SHA512
3d2700a34f05ae9e49d661c9800d444799d28efc68f7bc09259ac6107ea2901919e3a25b1f027a4d9c42abd5d234dc9b5267cdb647883f0dbec0d725fbaa890b
-
SSDEEP
24576:ieptIiqxy3j+8Pan8wrfVAv9gtHL/2kIwi/zMK28aLWtBkuIkV4rdX3ff9pTMMl:igvqo3jYntev6LOtPdbaqtBjIlHfFNMy
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\办公室游戏助手v2.3.exe"C:\Users\Admin\AppData\Local\Temp\办公室游戏助手v2.3.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
2.6MB
-
Filesize
2.6MB