Overview

overview

8

Static

static

8

2014-06-12_djylh.exe

windows7_x64

8

2014-06-12_djylh.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-06-2022 16:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2014-06-12_djylh.exe

  • Size

    1.0MB

  • MD5

    18b6865da4d3970fa3c102731ca82d96

  • SHA1

    39f2dc79978a6bf937aa588998b14ab05b70ff83

  • SHA256

    485a5454645f5d90d1b3097336b08dcaa9d4b49db9738a2f953e81081002600d

  • SHA512

    b99c73cb74f298e608a66353309fd5cde38cfeee552cb9c05d2a10e237fda421455c3acd7e435040d15162cf871cb425c9f7098ec6dcfbb2f90ee91a3b965486

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe
    "C:\Users\Admin\AppData\Local\Temp\2014-06-12_djylh.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3d0 0x464
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-130-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-131-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-132-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-134-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-136-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-140-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-138-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-141-0x0000000000400000-0x0000000000639000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1204-143-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-145-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-147-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-149-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-151-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-153-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-155-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-157-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-159-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-161-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-163-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-165-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-167-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-169-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-171-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-173-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download
  • memory/1204-174-0x0000000000400000-0x0000000000639000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/1204-175-0x0000000010000000-0x000000001003F000-memory.dmp
    Filesize

    252KB

    Download