Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 09:55

General

  • Target

    GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe

  • Size

    112KB

  • MD5

    06a7e93d59d85b421341e8f42a73304a

  • SHA1

    89921c4d91ed76695a36c22aebd58ce43f13ff46

  • SHA256

    ff4351ade586b170a211fcc58a91795a6e0c526d7e5714076210e32ab26c9132

  • SHA512

    cfdca04b1fe0eb08ebb82f5a4a3d0f52c7704c7feefc7b47691910563038994ec0e8fa7b599c5671861e88e39cc22e4a5e9b4f6c60af7a7ee2e48692b441d2c0

  • SSDEEP

    1536:5Cz3tcnp0HSOBVbky/z3tcnp0HSOBVbkyz9NKgkfdTlrrKhi+z3tcnp0HSOBVbky:5Cz92+jBjz92+jBsIi+z92+jB

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\辅助浏览器-Browser.exe
    "C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\辅助浏览器-Browser.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1724

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1724-4-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/1724-3-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/1724-2-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/1724-1-0x00000000749E0000-0x00000000750CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1724-0-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

          Filesize

          136KB

        • memory/1724-5-0x00000000749E0000-0x00000000750CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1724-6-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/1724-7-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB