605170a29e9799fda6c8dedc8c38976b0321fecc1dea8ee17c45e99b81179d7a | Triage

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 18:01

Sharing

Report Analysis Logs

General

Target

节操qq飞车体验服辅助v1.6正式版/节操qq飞车体验服辅助v1.6正式版.exe
Size

796KB
MD5

7197613aeda2dad65e206f6a4cf18355
SHA1

43c04c4fa4cd5b92004b43c5a2f1e93c9452fc8f
SHA256

d0abb16415af527e325b203740b596440e4baf4077e4f0cbc0cb414c64bf490d
SHA512

6f9254bf2f4f07ca2a4bbf5d0ceb505f47f9fd3404945b761babdea0b232a9c38841588b4291d40876a4054d91deabd7419f0168c45e6d83d7708fd121e5f87e
SSDEEP

12288:r6CdtIUW8uuzd1wX+M/q2MiR5nWFpPoSmXL:r6578Hzd1wJ/ubK

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	节操qq飞车体验服辅助v1.6正式版.exe
4852	节操qq飞车体验服辅助v1.6正式版.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4852	节操qq飞车体验服辅助v1.6正式版.exe
4852	节操qq飞车体验服辅助v1.6正式版.exe

C:\Users\Admin\AppData\Local\Temp\节操qq飞车体验服辅助v1.6正式版\节操qq飞车体验服辅助v1.6正式版.exe
"C:\Users\Admin\AppData\Local\Temp\节操qq飞车体验服辅助v1.6正式版\节操qq飞车体验服辅助v1.6正式版.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads