Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02-06-2024 13:46
General
-
Target
彩虹王国桌面版 ——小伟.exe
-
Size
358KB
-
MD5
856670c823bcef2e6cae13cb47cee035
-
SHA1
b36b1c1b31d07afefb8a28da9671c6a0c9106a0a
-
SHA256
3328c5491abd4e2feba601b0a6a32855598e0faa5fb342ed5222080eb294ca9e
-
SHA512
780edb58bfcc75321cbafef4146b3e6e86972ee4c0e9cd678dbb3c4441b4729546a4bd0ba1a618d1df74e20646abb1809fc6f3baa09f8d60141a4d833fe1c6e2
-
SSDEEP
6144:a6CX8UmLbJJ7dR2gk2dxqN3NSMZ+7TZ0mFb9poxxFv7X5LaukwDPAoSFN:bCMUOH7d5Ldx8PZ+XpN9pWxFvdOuR4oi
Score
7/10
Malware Config
Signatures
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\彩虹王国桌面版 ——小伟.exe"C:\Users\Admin\AppData\Local\Temp\彩虹王国桌面版 ——小伟.exe"1⤵
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 23082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 224 -ip 2241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
860KB
-
Filesize
248KB