Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 20:19

General

  • Target

    斗战神小梁辅助.exe

  • Size

    852KB

  • MD5

    f1ee198197adbf6fddbe29f522f58c8c

  • SHA1

    4bec5815b55690a5c69f5af5894566c36cfed581

  • SHA256

    03bf584dca3d676a2044a3f7062e2a69b6233c2368ac8de7c806c7d70d6e5876

  • SHA512

    2a0a19efedc9186c2be1932889622871d3f218e56fcdce3b9252e66941078470337b73e268fcb46a6a6937aa536c1295069f23173fba25695c3050321b9af2b9

  • SSDEEP

    12288:3aniS1QChHr051P3Demxv1A8+wizXa/JX20SdfaP5E1/SMZoSrF5KG9i:ZDvxNAJwizX1dfamQM/T4

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\斗战神小梁辅助.exe
    "C:\Users\Admin\AppData\Local\Temp\斗战神小梁辅助.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/536-26-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-32-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-47-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-46-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-45-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-40-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-39-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-37-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-30-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-28-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-22-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-20-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-18-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-16-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-15-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-12-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-10-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-8-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-6-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-4-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-2-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-1-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-24-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/536-0-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB