“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd

General
Target

“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

Filesize

3MB

Completed

27-07-2021 20:25

Score
6 /10
MD5

9ae32ad159d126278d9f7fc94f96adfa

SHA1

59469daf99f9fbc0b83d9fc1128af4e313f89b1b

SHA256

87930e435af99eda9ad298493193b5ca78d4c3aeba7747158f2e983e8ee4445f

Malware Config
Signatures 5

Filter: none

Discovery
  • Enumerates connected drives
    “赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\G:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\K:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\N:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\W:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\Z:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\T:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\U:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\X:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\Y:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\Q:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\S:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\B:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\E:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\F:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\I:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\M:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\O:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\V:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\H:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\J:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\L:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\P:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    File opened (read-only)\??\R:“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
  • Drops file in Program Files directory
    “赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\Ioiowwu.exe“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
  • Checks processor information in registry
    “赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
  • Suspicious behavior: EnumeratesProcesses
    “赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

    Reported IOCs

    pidprocess
    1756“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
  • Suspicious use of SetWindowsHookEx
    “赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe

    Reported IOCs

    pidprocess
    1756“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\“赌博就像溺水,让你喊不出救命。”专盯年轻女性下手!.cmd.exe"
    Enumerates connected drives
    Drops file in Program Files directory
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookEx
    PID:1756
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1756-60-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

                        • memory/1756-61-0x0000000010000000-0x0000000010018000-memory.dmp