63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26

Analysis

max time kernel
146s
max time network
177s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
Size

120KB
MD5

8f3224c97f8005c4c699f9ec6726d088
SHA1

2d7fa4a9ce69392e618cb1b074ef624cea3d07f4
SHA256

63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26
SHA512

45ad7b1c3795fa5dc161a11650053c1243624a87a8b8bf524975c05fd4923ffeaabac9224ae4def15483246dc67f754c012b7567131e56db3bb784eee2d2cf05
SSDEEP

3072:swR5g46PJh1OKknKplw5FmxoQmh2mRaOTnz:ZR2zBOKknU25PP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1200	¶¯Ì¬ÃÜ±£.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wind0ws\Parameters\ServiceDll = "C:\\Documents and Settings\\Local Server\\wanmei.dll"	¶¯Ì¬ÃÜ±£.exe

Loads dropped DLL 7 IoCs

pid	Process
1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
1200	¶¯Ì¬ÃÜ±£.exe
1200	¶¯Ì¬ÃÜ±£.exe
1200	¶¯Ì¬ÃÜ±£.exe
1164	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\FuckYou.txt	¶¯Ì¬ÃÜ±£.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2040	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1200	¶¯Ì¬ÃÜ±£.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1164	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	taskkill.exe
Token: SeBackupPrivilege	1200	¶¯Ì¬ÃÜ±£.exe
Token: SeRestorePrivilege	1200	¶¯Ì¬ÃÜ±£.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
964	DllHost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1792 wrote to memory of 1200	1792	63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe	28
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29
PID 1200 wrote to memory of 2040	1200	¶¯Ì¬ÃÜ±£.exe	29

C:\Users\Admin\AppData\Local\Temp\63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe
"C:\Users\Admin\AppData\Local\Temp\63c60784bc81ddfdeeb5a973fdcfc30adf0cdca98195556fb9bc3b201a470e26.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe
  "C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe"
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im ZhuDongFangYu.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2040

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:964

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MhLRMvpGv8.jpg

Filesize
28KB

MD5
45d4a0bed000d0abeef54046c8d75746

SHA1
99d096807bb2635c9f5d2d63d0c5f2fff34aba59

SHA256
02f80e548b6b89e9a132eceefd4f3313649906a75f90269992700ff8a64e44a6

SHA512
5e1b781065909229d6a6f4990dfa9d3b4834ef53b31bb017f49625bf59cb9928f2f25f1c3072fc37c5350f583a30210c502aa4eeea43dca11fa2efc2c7231b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\??\c:\documents and settings\local server\wanmei.dll

Filesize
105KB

MD5
67e11a234e9f1c96fd81f1695c5303c2

SHA1
c74ccbc2f80dcfe004bab8a8a98a4826ce0fdb15

SHA256
be4d73c747e922f5357808f87968a4565947def73313ea12347ed21b1fd71413

SHA512
c837fb849cd809225fa448309fd656cec66bb0b52d17eda3ead8a5b1d3062d7cbcc45f7a6a7482f5d28bef55bfb17e99e7dffc0c676c84bdfa4054238f816b9f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy5285.tmp\System.dll

Filesize
10KB

MD5
0c8ea8e6637bbf8408104e672d78ba45

SHA1
c231c7acaf9abb7da93f28e1b71bed164d57103e

SHA256
509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f

SHA512
ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28

Download Submit
\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\Users\Admin\AppData\Local\Temp\¶¯Ì¬ÃÜ±£.exe

Filesize
128KB

MD5
beaea5635620f8f418f2d0f7cd7214f4

SHA1
cfa7222030a3c878abff82149ef2f0f899638b2b

SHA256
43e865c58891a45fd048c33936881f5b6cccbf4da68e7889cf72ea5229d7895f

SHA512
7ea078a04b375f20f22216fc4475bb4ebc11c602510b5661c3e4216d5a05e2457674e2b3c7e59e5ef1b39e4fce644a1f3f09cbc945258606bb696d9eed294e7c

Download Submit
\Users\Local Server\wanmei.dll

Filesize
105KB

MD5
67e11a234e9f1c96fd81f1695c5303c2

SHA1
c74ccbc2f80dcfe004bab8a8a98a4826ce0fdb15

SHA256
be4d73c747e922f5357808f87968a4565947def73313ea12347ed21b1fd71413

SHA512
c837fb849cd809225fa448309fd656cec66bb0b52d17eda3ead8a5b1d3062d7cbcc45f7a6a7482f5d28bef55bfb17e99e7dffc0c676c84bdfa4054238f816b9f

Download Submit
memory/1164-71-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1164-73-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1792-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download