Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 09:55

General

  • Target

    GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe

  • Size

    112KB

  • MD5

    06a7e93d59d85b421341e8f42a73304a

  • SHA1

    89921c4d91ed76695a36c22aebd58ce43f13ff46

  • SHA256

    ff4351ade586b170a211fcc58a91795a6e0c526d7e5714076210e32ab26c9132

  • SHA512

    cfdca04b1fe0eb08ebb82f5a4a3d0f52c7704c7feefc7b47691910563038994ec0e8fa7b599c5671861e88e39cc22e4a5e9b4f6c60af7a7ee2e48692b441d2c0

  • SSDEEP

    1536:5Cz3tcnp0HSOBVbky/z3tcnp0HSOBVbkyz9NKgkfdTlrrKhi+z3tcnp0HSOBVbky:5Cz92+jBjz92+jBsIi+z92+jB

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\辅助浏览器-Browser.exe
    "C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\辅助浏览器-Browser.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1344
      2⤵
      • Program crash
      PID:3376
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3612 -ip 3612
    1⤵
      PID:4516

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3612-1-0x0000000074B90000-0x0000000075340000-memory.dmp

            Filesize

            7.7MB

          • memory/3612-0-0x00000000000B0000-0x00000000000D2000-memory.dmp

            Filesize

            136KB

          • memory/3612-2-0x00000000050D0000-0x0000000005674000-memory.dmp

            Filesize

            5.6MB

          • memory/3612-3-0x0000000004B20000-0x0000000004BB2000-memory.dmp

            Filesize

            584KB

          • memory/3612-4-0x0000000004CF0000-0x0000000004D00000-memory.dmp

            Filesize

            64KB

          • memory/3612-5-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

            Filesize

            40KB

          • memory/3612-6-0x0000000074B90000-0x0000000075340000-memory.dmp

            Filesize

            7.7MB

          • memory/3612-7-0x0000000004CF0000-0x0000000004D00000-memory.dmp

            Filesize

            64KB

          • memory/3612-8-0x0000000074B90000-0x0000000075340000-memory.dmp

            Filesize

            7.7MB