Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
新云软件.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
新云软件.url
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
淘宝推广程序(免安装).exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
General
-
Target
淘宝推广程序(免安装).exe
-
Size
72KB
-
MD5
b9a03885af0b3a1196479fd44a0beb02
-
SHA1
1d8bdb816e3fe4f435f8d8ab7daeff81a2fcac9e
-
SHA256
9297a9f0e1d9d221e8e100801e49f6004789c8a9acf92cbf41b9808607f133e8
-
SHA512
dd55ebeb79e8cc3b5db0d205b6b51852687acc58ce1c91bc28a9d94e395170cb0b7bad55df0df76c58768814f3a71d5b4c77243d7e5de7d0936679e0440de9c1
-
SSDEEP
768:fxw2d0vYkwCB8/2uscLHo1Ot0CIkU0dsh8BrFIjZraCbfzUmWQw2d:e2d0ATgqHHIYdsWBrGjZLbfzW/2d
Score
1/10
Malware Config
Signatures
-
Processes:
淘宝推广程序(免安装).exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main 淘宝推广程序(免安装).exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
淘宝推广程序(免安装).exepid process 1712 淘宝推广程序(免安装).exe 1712 淘宝推广程序(免安装).exe 1712 淘宝推广程序(免安装).exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-12-0x0000000005F50000-0x0000000006080000-memory.dmpFilesize
1.2MB