Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 18:26
General
- Target 经典·战神.exe
- Size 1.2MB
- Sample260916-w3prbssvcs
- SHA256 ba9923de60e31b49b658d48489b84e6c6498381efbd4e714726a5c40516b4a8f
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\经典·战神.exe"C:\Users\Admin\AppData\Local\Temp\经典·战神.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\经典·战神.ex_C:\Users\Admin\AppData\Local\Temp\经典·战神.ex_2⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\¾µä¡¤Õ½Éñ\经典·战神.ex_F:\¾µä¡¤Õ½Éñ\经典·战神.ex_3⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
经典·战神.ex_
Login.ico
memory/4464-77-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-78-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-81-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-82-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-84-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-85-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-88-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4464-91-0x0000000000400000-0x000000000194D000-memory.dmp
memory/4904-7-0x0000000002090000-0x0000000002091000-memory.dmp
memory/4904-9-0x0000000000400000-0x000000000194D000-memory.dmp