Overview
overview
5Static
static
5使用必读.url
windows7-x64
1使用必读.url
windows10-2004-x64
1如果无�...rk.url
windows7-x64
1如果无�...rk.url
windows10-2004-x64
1最新版�...��.url
windows7-x64
1最新版�...��.url
windows10-2004-x64
1洛克王�...��.exe
windows7-x64
5洛克王�...��.exe
windows10-2004-x64
5绿色软件园.url
windows7-x64
1绿色软件园.url
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 10:59
Behavioral task
behavioral1
Sample
使用必读.url
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
使用必读.url
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
如果无法运行,请先安装.NET Framework.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
如果无法运行,请先安装.NET Framework.url
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
最新版到ARP联盟搜索下载.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
最新版到ARP联盟搜索下载.url
Resource
win10v2004-20250313-en
Behavioral task
behavioral7
Sample
洛克王国菲菲辅助9.4无广告版.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
洛克王国菲菲辅助9.4无广告版.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
绿色软件园.url
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
绿色软件园.url
Resource
win10v2004-20250314-en
General
-
Target
洛克王国菲菲辅助9.4无广告版.exe
-
Size
777KB
-
MD5
5dc2d981b20fd1f1e3d5df04ace02138
-
SHA1
2f867da7e8868ed82680f5ac5b9b483149c24613
-
SHA256
9b8452217e0e37d95ca9371aad6a6621ed6360d22fca53f4aa992d9b3f0d7a46
-
SHA512
f816a919378556b3ae5243e1fafe4d0e8722881806bec0be6d5d9b8e8fed7808c2c80d06212b31370892bb56ff541996c1bfe859c7b274ef455cf0fac133d3a6
-
SSDEEP
12288:PTJmFW/3ZEV+NYBOa2qqdC2wP/o4FuaYuZess/6oc8vt4hpzp6:P9mMvZEV+e4uq02wXRQa5IRyyGTzp
Malware Config
Signatures
-
resource yara_rule behavioral8/memory/3900-0-0x0000000000400000-0x00000000005E4000-memory.dmp upx behavioral8/memory/3900-1-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-45-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-49-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-50-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-47-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-43-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-41-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-39-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-35-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-31-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-29-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-27-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-25-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-23-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-21-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-20-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-18-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-15-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-13-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-10-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-6-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-5-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-3-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-33-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-8-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-4-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral8/memory/3900-51-0x0000000000400000-0x00000000005E4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 洛克王国菲菲辅助9.4无广告版.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3900 洛克王国菲菲辅助9.4无广告版.exe 3900 洛克王国菲菲辅助9.4无广告版.exe 3900 洛克王国菲菲辅助9.4无广告版.exe 3900 洛克王国菲菲辅助9.4无广告版.exe 3900 洛克王国菲菲辅助9.4无广告版.exe