Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
ssQQkjxcplxzq/苏苏QQ空间相册批量下载器.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ssQQkjxcplxzq/苏苏QQ空间相册批量下载器.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ssQQkjxcplxzq/飘荡软件.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ssQQkjxcplxzq/飘荡软件.url
Resource
win10v2004-20240802-en
General
-
Target
ssQQkjxcplxzq/苏苏QQ空间相册批量下载器.exe
-
Size
1.8MB
-
MD5
1db3ba7e9a23f5b1b3ab0c91aabbeddb
-
SHA1
6935ea87153c246f8379693138ef0e6463497b6e
-
SHA256
8620f081ff26a2720dc5da15fa06d36aefc1a30e393f05c225b1da264228bdf8
-
SHA512
a08875265c3ef3d5fc2b5ee5eb0185c53c0432bb1d8111b8fc3e9d5f9d5951cd0c6a7023234555080c0de51d48dc1ddd487ce1575aba9f0b799fcd7ef396477a
-
SSDEEP
49152:toAVjN6wOmCGP3439NNTc+vX6LDfmEq2dSYZjw8uHxuBqfvtDTo+0:j3nvscL7v9w8UF0
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
pid Process 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 苏苏QQ空间相册批量下载器.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main 苏苏QQ空间相册批量下载器.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\591314.org 苏苏QQ空间相册批量下载器.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage 苏苏QQ空间相册批量下载器.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DOMStorage\591314.org\NumberOfSubdomains = "1" 苏苏QQ空间相册批量下载器.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.591314.org/?902203" 苏苏QQ空间相册批量下载器.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe 1876 苏苏QQ空间相册批量下载器.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ssQQkjxcplxzq\苏苏QQ空间相册批量下载器.exe"C:\Users\Admin\AppData\Local\Temp\ssQQkjxcplxzq\苏苏QQ空间相册批量下载器.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:1876