9c62826cc9da9cd62dd1c9178842dd7824e1ed9f0d39fb514c7f6edd0a9ea256

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

问剑大陆.exe
Size

11.8MB
MD5

17d8146ad837ae8ff5de658a2f392097
SHA1

88be3fef0e2a8a27f6e23b33ed99a2afc36018bc
SHA256

9c62826cc9da9cd62dd1c9178842dd7824e1ed9f0d39fb514c7f6edd0a9ea256
SHA512

67ef97acb8862e8226c1733ea43492be2ba0452ac6cfa01226a4f95a6a6303b2d12a72f9b04c3c49a7e65a54d2b3c855e00ad739a75618d67f88a555fd996844
SSDEEP

196608:H4r625EAqpGt/1BRCh8V2KQqGfyxXIicOExzUx8Bssun3f6B2+Zcdgbc:uxB8h8V2KQH6uBsc9Gx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2896	问剑大陆.exe
2896	问剑大陆.exe
2896	问剑大陆.exe
2896	问剑大陆.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	问剑大陆.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	问剑大陆.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	问剑大陆.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	问剑大陆.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	问剑大陆.exe

C:\Users\Admin\AppData\Local\Temp\问剑大陆.exe
"C:\Users\Admin\AppData\Local\Temp\问剑大陆.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WooolClient1003131\ÎÊ½£´óÂ½.exe

Filesize
2.4MB

MD5
003b13a68834713cdc66b33de871beab

SHA1
0a56752159db5f0562460c40e05f1d6dc2c3dea6

SHA256
d7b2ee5d6d9b25e51c79e067e1e4b51a93409613eb029e18a4772d500d58e9a7

SHA512
49e841f13c9cb009660d5f4f5da460413ecd271efdfb8fdfb6853699dd0ab705fdc65da186a5e10abe0fd539e8c7ace0cf8e394710c27480b39e526a0c4f204a

Download Submit
\Users\Admin\AppData\Local\Temp\WooolClient1003131\ÎÊ½£´óÂ½.exe

Filesize
2.3MB

MD5
79371a54521f340513a735c6f5e0e047

SHA1
51b7b96972ab622db36bb7e9177249fbe10cbe5b

SHA256
09ec71a5590a032d12e9bed58874bac48f3306e18072a53cfe0e267b3c090f0c

SHA512
32bd3f97d38f5e0a7158002ea41c4d8196b17f53348656f29dfb5749be61f46bac306c1cf1ad31b2e42628864705da0c1010ed0d56889f6f885dffa98c4512ff

Download Submit
\Users\Admin\AppData\Local\Temp\WooolClient1003131\ÎÊ½£´óÂ½.exe

Filesize
2.8MB

MD5
e3c2a4c65b4edb34fd3f80fb08dc01a5

SHA1
ab3234aef6970440258a035c3506d78f7234dd6d

SHA256
f7bd3639d71db485acaab96a69bb88b97312d5188625191370be2da30582437b

SHA512
27899d62ae322c43c2ef5ca253e335b23048423b048a8340db789d9101398755525f9e717b4d295df5baf89c2c6f69beb7991700f8842461c3e9a6e83956ebfb

Download Submit
\Users\Admin\AppData\Local\Temp\WooolClient1003131\ÎÊ½£´óÂ½.exe

Filesize
2.8MB

MD5
28cc9dfd38e3ff851fe2d84e61817470

SHA1
0c7924c9f9d59b1b5474051fae52c66bcfa4773b

SHA256
e8f341db18a2d114e6e27b5e5044d3cc45f2cc3c1049db0e81c2a230f0151fce

SHA512
5cc08e5bce912bef188cc840cdf53c2fe55539ad70876c56b05760f0e499cc4f94e1610168351e4cd9705b18f672a14ca46802ce7e42738f080b7efc2617b0c2

Download Submit
\Users\Admin\AppData\Local\Temp\WooolClient1003131\ÎÊ½£´óÂ½.exe

Filesize
2.4MB

MD5
ca320809aa1ad5af804b8cc66c37637b

SHA1
66a0d3f2a902b9e9885a6908d0f25c5abf93c169

SHA256
477226b21d5420bbbb2b924581f2a4d06b59f28624ec41950bdb5f0b0fe7e1cd

SHA512
955a5bb124a0b2c0abce51339a9d7de527466e4ef06e13a13bea4ed2d2ffa44a9a0ef29870825e897d23962378a6fbe2ce3e1055b32854e167a3ac7a8299284d

Download Submit
memory/2896-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2896-2-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2896-12-0x0000000000400000-0x0000000000FE8000-memory.dmp

Filesize
11.9MB

Download
memory/2896-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2896-15-0x0000000000400000-0x0000000000FE8000-memory.dmp

Filesize
11.9MB

Download
memory/2896-16-0x0000000000400000-0x0000000000FE8000-memory.dmp

Filesize
11.9MB

Download