Overview
overview
7Static
static
3凌云快�...��.exe
windows7-x64
3凌云快�...��.exe
windows10-2004-x64
3凌云快�...��.url
windows7-x64
1凌云快�...��.url
windows10-2004-x64
1凌云快�...il.lnk
windows7-x64
6凌云快�...il.lnk
windows10-2004-x64
6凌云快�...er.lnk
windows7-x64
3凌云快�...er.lnk
windows10-2004-x64
7凌云快�...32.lnk
windows7-x64
3凌云快�...32.lnk
windows10-2004-x64
3凌云快�...C).lnk
windows7-x64
3凌云快�...C).lnk
windows10-2004-x64
3凌云快�...��.lnk
windows7-x64
6凌云快�...��.lnk
windows10-2004-x64
7凌云快�...��.lnk
windows7-x64
3凌云快�...��.lnk
windows10-2004-x64
7凌云快�...��.lnk
windows7-x64
3凌云快�...��.lnk
windows10-2004-x64
3凌云快�...��.lnk
windows7-x64
3凌云快�...��.lnk
windows10-2004-x64
3凌云快�...��.lnk
windows7-x64
5凌云快�...��.lnk
windows10-2004-x64
7凌云快�...��.lnk
windows7-x64
3凌云快�...��.lnk
windows10-2004-x64
7凌云快�...��.exe
windows7-x64
3凌云快�...��.exe
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 06:22
Static task
static1
Behavioral task
behavioral1
Sample
凌云快速打开文件夹/凌云快速打开文件夹.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
凌云快速打开文件夹/凌云快速打开文件夹.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
凌云快速打开文件夹/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
凌云快速打开文件夹/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
凌云快速打开文件夹/程序快捷方式总集/Foxmail.lnk
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
凌云快速打开文件夹/程序快捷方式总集/Foxmail.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
凌云快速打开文件夹/程序快捷方式总集/explorer.lnk
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
凌云快速打开文件夹/程序快捷方式总集/explorer.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
凌云快速打开文件夹/程序快捷方式总集/system32.lnk
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
凌云快速打开文件夹/程序快捷方式总集/system32.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
凌云快速打开文件夹/程序快捷方式总集/winxp (C).lnk
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
凌云快速打开文件夹/程序快捷方式总集/winxp (C).lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
凌云快速打开文件夹/程序快捷方式总集/可自由添加删除.lnk
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
凌云快速打开文件夹/程序快捷方式总集/可自由添加删除.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
凌云快速打开文件夹/程序快捷方式总集/注册表编辑.lnk
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
凌云快速打开文件夹/程序快捷方式总集/注册表编辑.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
凌云快速打开文件夹/程序快捷方式总集/系统配置实用程序.lnk
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
凌云快速打开文件夹/程序快捷方式总集/系统配置实用程序.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
凌云快速打开文件夹/程序快捷方式总集/系统配置编辑器.lnk
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
凌云快速打开文件夹/程序快捷方式总集/系统配置编辑器.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
凌云快速打开文件夹/程序快捷方式总集/组策略.lnk
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
凌云快速打开文件夹/程序快捷方式总集/组策略.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
凌云快速打开文件夹/程序快捷方式总集/记事本.lnk
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
凌云快速打开文件夹/程序快捷方式总集/记事本.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
凌云快速打开文件夹/软件发布之最佳伴侣_用户反馈表/软件发布之最佳伴侣_用户反馈表.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
凌云快速打开文件夹/软件发布之最佳伴侣_用户反馈表/软件发布之最佳伴侣_用户反馈表.exe
Resource
win10v2004-20240802-en
General
-
Target
凌云快速打开文件夹/程序快捷方式总集/explorer.lnk
-
Size
474B
-
MD5
59e28374b3576eb60e54a682974bd2f2
-
SHA1
79211ad9d5552a1b12e035d0242919df5eb4a72c
-
SHA256
a0b2cceb567ca5b926c14328c9742921b1149525d0994708900b70f25aaa7675
-
SHA512
f8b150ce64849574432904320ba4359a3bce12842fcd572402e9ba09afe9e811864768b8b5ab699a0d1af622da27cb490ad943f46dcf7f4e67dc83b5d57b52c9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2704 1964 cmd.exe 31 PID 1964 wrote to memory of 2704 1964 cmd.exe 31 PID 1964 wrote to memory of 2704 1964 cmd.exe 31