Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 00:33
General
-
Target
乡巴佬CS登录器V3.5 [测试].exe
-
Size
1.9MB
-
MD5
c782a3edffde23f97403896a4e80ff81
-
SHA1
48d7ed6c5ebad5fed8bb1dda4c92288342bb83fb
-
SHA256
cb43d1edbb37c97b68b2a2eab066e4fa9f56ed04ae9a8d0e0ea1ba09273899b9
-
SHA512
2c8d3de2601226a2522cd89ee055e0b8beaf2b550b6e5f4ea9daa84b1751aa4c3318c65eeb9aef0eb8419fb0b83d247830d332bbe72d80736c8c4af47a85dbd7
-
SSDEEP
24576:ERGJvZko+Fheb9uxqsVBs77deWwUXGuBeYIXQ7deWwUXGujs1bZU2XX:RJvuo+FY8BEFIYo6Fja
Score
7/10
Malware Config
Signatures
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\乡巴佬CS登录器V3.5 [测试].exe"C:\Users\Admin\AppData\Local\Temp\乡巴佬CS登录器V3.5 [测试].exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB