8f1d957803f3501d26f385df4f2f92408b9bd1cbf825ac7bce3584a495253486

Analysis

max time kernel
68s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apwifi无线路由软件 V1066绿色破解版_3775489879.exe
Size

6.7MB
MD5

65c6c55ff7a297cb8038ed701d6cdef1
SHA1

70bc9fabbc72224d3ad5ad54211e2e6865aefc9c
SHA256

8f1d957803f3501d26f385df4f2f92408b9bd1cbf825ac7bce3584a495253486
SHA512

80521a7a5592d6bd52187af31c6a293802a7d654308ec0f3aab234e3e0df294b7439d510973bc8db5ea85bb1a80e5532fdbcf9f75e401935046441065ab1dac6
SSDEEP

98304:2TOYcpeE6kT/hh5UhamPSzGOljFbY/qAt8Z06Sgn6W9BO+xmLaGDaQHmm/z:moehkKhhaz/lBbY/qAtifSZOt8aeb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

apwifi无线路由软件 V1066绿色破解版_3775489879.exeapwifi无线路由软件 V1066绿色破解版_3775489879.exe

pid	process
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
4392	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

apwifi无线路由软件 V1066绿色破解版_3775489879.exe

pid process

5188 apwifi无线路由软件 V1066绿色破解版_3775489879.exe

pid	process
5188	apwifi无线路由软件 V1066绿色破解版_3775489879.exe

C:\Users\Admin\AppData\Local\Temp\apwifi无线路由软件 V1066绿色破解版_3775489879.exe
"C:\Users\Admin\AppData\Local\Temp\apwifi无线路由软件 V1066绿色破解版_3775489879.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5292

C:\Users\Admin\AppData\Local\Temp\apwifi无线路由软件 V1066绿色破解版_3775489879.exe
"C:\Users\Admin\AppData\Local\Temp\apwifi无线路由软件 V1066绿色破解版_3775489879.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4392-0-0x0000000000E70000-0x00000000019E9000-memory.dmp

Filesize
11.5MB

Download
memory/4392-1-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/4392-2-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4392-3-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4392-4-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/4392-5-0x00000000034B0000-0x00000000034B1000-memory.dmp

Filesize
4KB

Download
memory/4392-6-0x00000000034C0000-0x00000000034C1000-memory.dmp

Filesize
4KB

Download
memory/4392-8-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4392-13-0x0000000077812000-0x0000000077813000-memory.dmp

Filesize
4KB

Download
memory/4392-12-0x0000000077950000-0x0000000077960000-memory.dmp

Filesize
64KB

Download
memory/4392-14-0x0000000077950000-0x0000000077960000-memory.dmp

Filesize
64KB

Download
memory/4392-15-0x0000000000E70000-0x00000000019E9000-memory.dmp

Filesize
11.5MB

Download
memory/5188-16-0x0000000000E70000-0x00000000019E9000-memory.dmp

Filesize
11.5MB

Download
memory/5188-18-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/5188-17-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/5188-19-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/5188-20-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Filesize
4KB

Download
memory/5188-21-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/5188-22-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

Filesize
4KB

Download
memory/5188-23-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/5188-29-0x0000000077812000-0x0000000077813000-memory.dmp

Filesize
4KB

Download
memory/5188-30-0x0000000000E70000-0x00000000019E9000-memory.dmp

Filesize
11.5MB

Download