Overview

overview

8

Static

static

8

2014-06-12_djylh.exe

windows7_x64

8

2014-06-12_djylh.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    153s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    04-04-2022 03:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2014-06-12_djylh.exe

  • Size

    1.0MB

  • MD5

    18b6865da4d3970fa3c102731ca82d96

  • SHA1

    39f2dc79978a6bf937aa588998b14ab05b70ff83

  • SHA256

    485a5454645f5d90d1b3097336b08dcaa9d4b49db9738a2f953e81081002600d

  • SHA512

    b99c73cb74f298e608a66353309fd5cde38cfeee552cb9c05d2a10e237fda421455c3acd7e435040d15162cf871cb425c9f7098ec6dcfbb2f90ee91a3b965486

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe
    "C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1496
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4b8 0x4f8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1496-124-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-126-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-125-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-128-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-130-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-132-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-142-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-140-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-138-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-136-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-146-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-144-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-134-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-150-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-148-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-152-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-156-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-154-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-160-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-158-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-164-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-166-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-162-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1496-167-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download