09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae

Analysis

max time kernel
96s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
Size

1.6MB
MD5

66e6308b1a93ea9ce41174a6e7a8a3d8
SHA1

2b7af9b4940a99128e8d9915a257b2bf70ab8d13
SHA256

09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae
SHA512

06145c7d104c6fa1e793528f093992127bacfdb1a4b7f6f1e36dd02d4e9c8bebb7671d1ef4d339c1b7d26a5301c9e735c9f597c417762375b9876514a5ac577d
SSDEEP

49152:1IhZf19vPlSpr5mZxKHWkNB46jBECLgWBWQgWG5+XqJ0:+BvtSpsZjkNiEECJcQgWG5+XqJ0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
872	tools.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PDF\2.pdf	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File opened for modification	C:\Program Files (x86)\PDF\2.pdf	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File opened for modification	C:\Program Files (x86)\PDF\tools.exe	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File created	C:\Program Files (x86)\PDF\说明.txt	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File opened for modification	C:\Program Files (x86)\PDF	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File created	C:\Program Files (x86)\PDF\__tmp_rar_sfx_access_check_240557984	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File created	C:\Program Files (x86)\PDF\杀软误报说明.txt	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File opened for modification	C:\Program Files (x86)\PDF\杀软误报说明.txt	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File created	C:\Program Files (x86)\PDF\tools.exe	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
File opened for modification	C:\Program Files (x86)\PDF\说明.txt	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
872	tools.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
872	tools.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
872	tools.exe
872	tools.exe
872	tools.exe
872	tools.exe
872	tools.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 872	3404	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe	82
PID 3404 wrote to memory of 872	3404	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe	82
PID 3404 wrote to memory of 872	3404	09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe	82

C:\Users\Admin\AppData\Local\Temp\09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe
"C:\Users\Admin\AppData\Local\Temp\09f77e78f55ebf673f9c3bb59d2732059bd671af0c45a8d468ba3854bf7656ae.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\PDF\tools.exe
  "C:\Program Files (x86)\PDF\tools.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PDF\tools.exe

Filesize
708KB

MD5
3195b51d9e352cecfab351f68bab99a2

SHA1
14fdcab853083bc4ed654e8e2d254d4c71a6e252

SHA256
3ffdd7276e98bb50abf2fcbb81b764714f1e7e7fcac04541c6eef45221c25103

SHA512
fea99a34017fb2d60ccfb529988e7182fa21294a57768a10eb3ef6bb16ea8c6aa93cee848a2a419c90cdad8da14d83c29a3d5bae7988bdf2d163606ac0a06413

Download Submit
C:\Program Files (x86)\PDF\tools.exe

Filesize
708KB

MD5
3195b51d9e352cecfab351f68bab99a2

SHA1
14fdcab853083bc4ed654e8e2d254d4c71a6e252

SHA256
3ffdd7276e98bb50abf2fcbb81b764714f1e7e7fcac04541c6eef45221c25103

SHA512
fea99a34017fb2d60ccfb529988e7182fa21294a57768a10eb3ef6bb16ea8c6aa93cee848a2a419c90cdad8da14d83c29a3d5bae7988bdf2d163606ac0a06413

Download Submit