0f4731f0ee1ca1b4042d98a66eb7369d80f4823816ac3d1617287d712bf42d14

Analysis

max time kernel
30s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

古典四大名著连环画珍藏版(EXE)/三国演义连环画.exe
Size

5.5MB
MD5

40a2a0a58853c60394ee599844d4118a
SHA1

ad44ddf2946b6bbd34fca9b36431d6f54fdad2ba
SHA256

70358699b16f39b094ba8ea936c6a1e8041bba875a33996a01c3655801ba7552
SHA512

9d00059dd7b66f918acee3eaaf0e4ff3731236cfadb62afb3891dcb8f242390fb2af352838794776f6754597580d4f413412d8b336e01669b75d2e4946f94020
SSDEEP

98304:gFN+foVmJHfZD3sy+7dCUkfsqHOCliEBc7DZLdoQY:kKoVmVhrf0kEwOAiCcl6QY

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wc98pp.dll	三国演义连环画.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	三国演义连环画.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	三国演义连环画.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	三国演义连环画.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	三国演义连环画.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	三国演义连环画.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	三国演义连环画.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	三国演义连环画.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	三国演义连环画.exe
4136	三国演义连环画.exe

C:\Users\Admin\AppData\Local\Temp\古典四大名著连环画珍藏版(EXE)\三国演义连环画.exe
"C:\Users\Admin\AppData\Local\Temp\古典四大名著连环画珍藏版(EXE)\三国演义连环画.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4136-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4136-2-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/4136-4-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download