403563a713f4c0d458404e650d814a4497b2e61a1608bbe58c2e1fde191eb57c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

蘑菇QQ消息轰炸机V1.9.exe
Size

32KB
MD5

0a5e0567a9a0cb4ec728d2fd8d21febd
SHA1

8f72bfb528be046a01d7bf3bc63adeb57985fcee
SHA256

bd98b567dc4cdee280717ed2170041e09d0e0d0aa9e6c9cc5d8f7070f99634b3
SHA512

4fe290c3a27f418e054ac043c4aa9325ddd22ede0633a07970b1a27ec9b5302557413b3a0cecb03003f1ba087456a10a7404c5cf86e730b5b1abb2e40ba07fbc
SSDEEP

384:qwYC075ARAULf1cDNhjkNGGJrZ5cMYTgyqIYC07EI:ACcAIDHYNGGNZGMEBq9C0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	蘑菇QQ消息轰炸机V1.9.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2168	蘑菇QQ消息轰炸机V1.9.exe
2168	蘑菇QQ消息轰炸机V1.9.exe
2168	蘑菇QQ消息轰炸机V1.9.exe

C:\Users\Admin\AppData\Local\Temp\蘑菇QQ消息轰炸机V1.9.exe
"C:\Users\Admin\AppData\Local\Temp\蘑菇QQ消息轰炸机V1.9.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-2-0x00000000044B0000-0x0000000005512000-memory.dmp

Filesize
16.4MB

Download