Analysis
- max time kernel
163s - max time network
140s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
19/03/2024, 23:22
Behavioral task
behavioral1
Sample
页游神/LiveUpdate.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
页游神/LiveUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
页游神/新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
页游神/新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
页游神/页游神.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
页游神/页游神.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 页游神/页游神.exe
- Size 412KB
- Sample240319-3cwwaaac98
- SHA256 586f8161a4fedae1613bedf778a002ba15d4f417821007cef3a857e3e13ab67d
- MD5 45534654f4cc31df81d06b17f3637f64
- SHA1 62bbbc97423bd00f21dd2a123133126be6fc8b7f
- SHA512 c17b7aabcd92b5c976f3bfea99f3c76a9f5d46b9374681bb9617f6f84f562eba58f38f48fe9cf90017c1fe5eff058760d46f73aa0a41f116376ec12bdf30a8b5
- SSDEEP 6144:P18MXjJcqiQWlwupAzVM1o26UFsEYV5BYOXhnnVxePZVoWuE6W4ULT0v1M:P18GDru6ziOWYY6nnVxePkWp6oYN
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe 2504 页游神.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2504 页游神.exe 2504 页游神.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27 PID 2504 wrote to memory of 2524 2504 页游神.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\页游神\页游神.exe"C:\Users\Admin\AppData\Local\Temp\页游神\页游神.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\页游神\LiveUpdate.exeLiveUpdate.exe -ar2⤵PID:2524
-