Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 00:47

General

  • Target

    ssQQkjxcplxzq/苏苏QQ空间相册批量下载器.exe

  • Size

    1.8MB

  • MD5

    1db3ba7e9a23f5b1b3ab0c91aabbeddb

  • SHA1

    6935ea87153c246f8379693138ef0e6463497b6e

  • SHA256

    8620f081ff26a2720dc5da15fa06d36aefc1a30e393f05c225b1da264228bdf8

  • SHA512

    a08875265c3ef3d5fc2b5ee5eb0185c53c0432bb1d8111b8fc3e9d5f9d5951cd0c6a7023234555080c0de51d48dc1ddd487ce1575aba9f0b799fcd7ef396477a

  • SSDEEP

    49152:toAVjN6wOmCGP3439NNTc+vX6LDfmEq2dSYZjw8uHxuBqfvtDTo+0:j3nvscL7v9w8UF0

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ssQQkjxcplxzq\苏苏QQ空间相册批量下载器.exe
    "C:\Users\Admin\AppData\Local\Temp\ssQQkjxcplxzq\苏苏QQ空间相册批量下载器.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious use of SetWindowsHookEx
    PID:1876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1876-0-0x0000000000400000-0x0000000000673000-memory.dmp

    Filesize

    2.4MB

  • memory/1876-1-0x00000000777E0000-0x0000000077827000-memory.dmp

    Filesize

    284KB

  • memory/1876-503-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-504-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-506-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-508-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-510-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-516-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-514-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-512-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-518-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-520-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-522-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-524-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-526-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-528-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-530-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-540-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-534-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-532-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-536-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-538-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-544-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-546-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-542-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-548-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-550-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-552-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-554-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-557-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-560-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-558-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-564-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-562-0x0000000002300000-0x0000000002411000-memory.dmp

    Filesize

    1.1MB

  • memory/1876-8132-0x0000000000400000-0x0000000000673000-memory.dmp

    Filesize

    2.4MB