Analysis
-
max time kernel
140s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 19:11
Behavioral task
behavioral1
Sample
icohq/ico图标获取器V2.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
icohq/ico图标获取器V2.0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
icohq/新云软件.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
icohq/新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
icohq/ico图标获取器V2.0.exe
-
Size
376KB
-
MD5
b8b287f7116c91734e24a94b8e7d6532
-
SHA1
88f29957bd8bf15a5f598ef051e91c70417829dc
-
SHA256
a60b0c34e23ce19f737e015e5424507abfd3f0bb5c5dee4474f85e357ae26b3c
-
SHA512
84babea9964a9bbb5286dcb0a29990b79f2e7619b051a8fa336a79affecb89fb2b7107e6a920eaa15ab27ce6b2ddf8397f474d82cca89d1d3a28d1faa58b0ea8
-
SSDEEP
6144:LsB3fpuAQ/comXWtWB9QDH2m025Uby3sT5DOQuEXuauLWBjkUKy:o3oBmXWtoM2u5Ubis10EDuaBwUK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ico图标获取器V2.0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3368 ico图标获取器V2.0.exe