Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19/07/2024, 16:47
General
-
Target
保姆小黑_V2.32-QQ摩天大楼辅助_By_Loading/保姆小黑 V2.32-QQ摩天大楼辅助 By Loading.exe
-
Size
823KB
-
MD5
7864332afd716e90dccd6bc4bafd1019
-
SHA1
90c79933489825562fb6b848391a3ef1d7aca98f
-
SHA256
489a0b38b51824d771474b76b7e697ebf52aa93707ad40935a32a3a6d6740dfd
-
SHA512
3f7e27b51708cfec6651831b2405a7e48667106ecd6eac72b7f0c73705f608eb422f9b4c1c66e0a3480830208e0cf7597e791017af2e2568ebb1c1230a72777d
-
SSDEEP
12288:cF76NG9lWlWl8lWlKlJlBSQhZsV1SQhZsVhxRx4rKc0SQh5sV:cF76M5A5joJ/
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\保姆小黑_V2.32-QQ摩天大楼辅助_By_Loading\保姆小黑 V2.32-QQ摩天大楼辅助 By Loading.exe"C:\Users\Admin\AppData\Local\Temp\保姆小黑_V2.32-QQ摩天大楼辅助_By_Loading\保姆小黑 V2.32-QQ摩天大楼辅助 By Loading.exe"1⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
280KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
48KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB