Overview
overview
8Static
static
881411125/2...t2.exe
windows7-x64
381411125/2...t2.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t2.exe
windows7-x64
381411125/2...t2.exe
windows10-2004-x64
381411125/2...t2.exe
windows7-x64
381411125/2...t2.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
481411125/2...t1.exe
windows10-2004-x64
481411125/2...t2.exe
windows7-x64
381411125/2...t2.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...rd.exe
windows7-x64
381411125/2...rd.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
381411125/2...t2.exe
windows7-x64
381411125/2...t2.exe
windows10-2004-x64
381411125/2...t1.exe
windows7-x64
381411125/2...t1.exe
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17-08-2024 18:32
Behavioral task
behavioral1
Sample
81411125/250 建立临时表并将其内容保存到永久表中/Project2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
81411125/250 建立临时表并将其内容保存到永久表中/Project2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
81411125/251 创建一个和原始表结构相同的新表/Project1.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
81411125/251 创建一个和原始表结构相同的新表/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
81411125/252 将一个字段中的内容导入到ListBox控件中/Project1.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
81411125/252 将一个字段中的内容导入到ListBox控件中/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
81411125/253 将数据库中的内容添加到OutLine控件中/Project2.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
81411125/253 将数据库中的内容添加到OutLine控件中/Project2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
81411125/255 向图表中插入背景图片/Project2.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
81411125/255 向图表中插入背景图片/Project2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
81411125/256 在DBGrid控件中显示图片/Project1.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
81411125/256 在DBGrid控件中显示图片/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
81411125/257 取消DBGrid控件添加新记录/Project1.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
81411125/257 取消DBGrid控件添加新记录/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
81411125/259 单击DBGrid的标题进行排序/Project1.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
81411125/259 单击DBGrid的标题进行排序/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
81411125/260 转换数据库/Project2.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
81411125/260 转换数据库/Project2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
81411125/261 提示数据库正在使用/Project1.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
81411125/261 提示数据库正在使用/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
81411125/262 如何判断重复的值并进行提示/Project1.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
81411125/262 如何判断重复的值并进行提示/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
81411125/263 图像数据的存取/Project1.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
81411125/263 图像数据的存取/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
81411125/265 数据库与多线程/BDEThrd.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
81411125/265 数据库与多线程/BDEThrd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
81411125/266 登陆程序/Project1.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
81411125/266 登陆程序/Project1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
81411125/266 登陆程序/Project2.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
81411125/266 登陆程序/Project2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
81411125/268 使用书签/Project1.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
81411125/268 使用书签/Project1.exe
Resource
win10v2004-20240802-en
General
-
Target
81411125/253 将数据库中的内容添加到OutLine控件中/Project2.exe
-
Size
822KB
-
MD5
129620bb318a2692e4826807aa52608b
-
SHA1
03cdc87c6cc232091d62ff8830f58c40475d9753
-
SHA256
f8d784381836028c608ff4265f7cd8c9c0882678c928550ae119e012d59f5112
-
SHA512
e4f5cb9ee313b2f5918649833c88c408eb7d4acda32b5428f1ec3b92759bd34be9ec516f21691f8d962d3df30225649d7f4fdfc4ca8396b98f0e1c05db1e4898
-
SSDEEP
12288:X3MirNxNByo1iz2mpqiSVsMuzTR+IP3Pg7/Z3WkOR+xm7+LSG12gA0H9tDItk8:siNxKzz29VsPFCEf++tk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 988 1732 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Project2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 988 1732 Project2.exe 29 PID 1732 wrote to memory of 988 1732 Project2.exe 29 PID 1732 wrote to memory of 988 1732 Project2.exe 29 PID 1732 wrote to memory of 988 1732 Project2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\81411125\253 将数据库中的内容添加到OutLine控件中\Project2.exe"C:\Users\Admin\AppData\Local\Temp\81411125\253 将数据库中的内容添加到OutLine控件中\Project2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 2322⤵
- Program crash
PID:988
-