a3c508ce5ec079fbd0201301e72101ebeafaf39b972525a175fd5c5d46e7fb04

Analysis

max time kernel
37s
max time network
38s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/10/2022, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Edius_v6.02_的破解文件/lpk.dll
Size

61KB
MD5

c7dd44964be170becb663dc49a229f1f
SHA1

5be47ba7be673ce010a00726eea84b0c44ee6801
SHA256

d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e
SHA512

ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f
SSDEEP

1536:KNt2E5lBYVKYN4b1HZooqfZ9zksBXNt2E5l:talWKC4b1HZooqB9dB+al

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1708	hrl6884.tmp
1288	AliveService.exe
1460	hrl6C3C.tmp

Loads dropped DLL 7 IoCs

pid	Process
1620	rundll32.exe
1620	rundll32.exe
1708	hrl6884.tmp
1288	AliveService.exe
1288	AliveService.exe
1288	AliveService.exe
1460	hrl6C3C.tmp

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	AliveService.exe
File opened (read-only)	\??\K:	hrl6884.tmp
File opened (read-only)	\??\N:	hrl6884.tmp
File opened (read-only)	\??\Y:	hrl6884.tmp
File opened (read-only)	\??\F:	AliveService.exe
File opened (read-only)	\??\E:	hrl6884.tmp
File opened (read-only)	\??\H:	hrl6884.tmp
File opened (read-only)	\??\S:	hrl6C3C.tmp
File opened (read-only)	\??\E:	hrl6C3C.tmp
File opened (read-only)	\??\H:	hrl6C3C.tmp
File opened (read-only)	\??\I:	hrl6C3C.tmp
File opened (read-only)	\??\N:	hrl6C3C.tmp
File opened (read-only)	\??\G:	AliveService.exe
File opened (read-only)	\??\X:	hrl6C3C.tmp
File opened (read-only)	\??\I:	hrl6884.tmp
File opened (read-only)	\??\H:	AliveService.exe
File opened (read-only)	\??\Y:	AliveService.exe
File opened (read-only)	\??\R:	hrl6C3C.tmp
File opened (read-only)	\??\R:	hrl6884.tmp
File opened (read-only)	\??\J:	AliveService.exe
File opened (read-only)	\??\W:	AliveService.exe
File opened (read-only)	\??\G:	hrl6C3C.tmp
File opened (read-only)	\??\T:	hrl6884.tmp
File opened (read-only)	\??\S:	AliveService.exe
File opened (read-only)	\??\J:	hrl6C3C.tmp
File opened (read-only)	\??\P:	hrl6884.tmp
File opened (read-only)	\??\Q:	hrl6884.tmp
File opened (read-only)	\??\W:	hrl6884.tmp
File opened (read-only)	\??\Q:	AliveService.exe
File opened (read-only)	\??\S:	hrl6884.tmp
File opened (read-only)	\??\E:	AliveService.exe
File opened (read-only)	\??\Z:	hrl6884.tmp
File opened (read-only)	\??\F:	hrl6C3C.tmp
File opened (read-only)	\??\O:	hrl6C3C.tmp
File opened (read-only)	\??\P:	hrl6C3C.tmp
File opened (read-only)	\??\J:	hrl6884.tmp
File opened (read-only)	\??\T:	AliveService.exe
File opened (read-only)	\??\U:	AliveService.exe
File opened (read-only)	\??\K:	hrl6C3C.tmp
File opened (read-only)	\??\T:	hrl6C3C.tmp
File opened (read-only)	\??\F:	hrl6884.tmp
File opened (read-only)	\??\O:	hrl6884.tmp
File opened (read-only)	\??\U:	hrl6884.tmp
File opened (read-only)	\??\R:	AliveService.exe
File opened (read-only)	\??\U:	hrl6C3C.tmp
File opened (read-only)	\??\M:	hrl6C3C.tmp
File opened (read-only)	\??\V:	hrl6C3C.tmp
File opened (read-only)	\??\Y:	hrl6C3C.tmp
File opened (read-only)	\??\Z:	hrl6C3C.tmp
File opened (read-only)	\??\G:	hrl6884.tmp
File opened (read-only)	\??\L:	hrl6884.tmp
File opened (read-only)	\??\K:	AliveService.exe
File opened (read-only)	\??\N:	AliveService.exe
File opened (read-only)	\??\V:	AliveService.exe
File opened (read-only)	\??\Z:	AliveService.exe
File opened (read-only)	\??\Q:	hrl6C3C.tmp
File opened (read-only)	\??\M:	hrl6884.tmp
File opened (read-only)	\??\V:	hrl6884.tmp
File opened (read-only)	\??\X:	hrl6884.tmp
File opened (read-only)	\??\I:	AliveService.exe
File opened (read-only)	\??\L:	hrl6C3C.tmp
File opened (read-only)	\??\W:	hrl6C3C.tmp
File opened (read-only)	\??\L:	AliveService.exe
File opened (read-only)	\??\M:	AliveService.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\AliveService.exe	hrl6884.tmp
File created	C:\Windows\SysWOW64\Black.dll	hrl6884.tmp
File opened for modification	C:\Windows\SysWOW64\RCX6AF4.tmp	hrl6884.tmp
File created	C:\Windows\SysWOW64\Black.dll	AliveService.exe
File opened for modification	C:\Windows\SysWOW64\RCX6C2C.tmp	AliveService.exe
File created	C:\Windows\SysWOW64\Black.dll	hrl6C3C.tmp
File opened for modification	C:\Windows\SysWOW64\RCX6C99.tmp	hrl6C3C.tmp
File created	C:\Windows\SysWOW64\AliveService.exe	hrl6884.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1708	hrl6884.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	hrl6884.tmp
1708	hrl6884.tmp
1288	AliveService.exe
1288	AliveService.exe
1460	hrl6C3C.tmp
1460	hrl6C3C.tmp

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1288 wrote to memory of 1460	1288	AliveService.exe	29
PID 1288 wrote to memory of 1460	1288	AliveService.exe	29
PID 1288 wrote to memory of 1460	1288	AliveService.exe	29
PID 1288 wrote to memory of 1460	1288	AliveService.exe	29
PID 1708 wrote to memory of 1936	1708	hrl6884.tmp	30
PID 1708 wrote to memory of 1936	1708	hrl6884.tmp	30
PID 1708 wrote to memory of 1936	1708	hrl6884.tmp	30
PID 1708 wrote to memory of 1936	1708	hrl6884.tmp	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Edius_v6.02_的破解文件\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Edius_v6.02_的破解文件\lpk.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\hrl6884.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl6884.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrl6884.tmp > nul
      4⤵
      PID:1936

C:\Windows\SysWOW64\AliveService.exe
C:\Windows\SysWOW64\AliveService.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\TEMP\hrl6C3C.tmp
  C:\Windows\TEMP\hrl6C3C.tmp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lpk.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrl6884.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrl6884.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\AliveService.exe

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\AliveService.exe

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
C:\Windows\Temp\hrl6C3C.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
\Users\Admin\AppData\Local\Temp\hrl6884.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
\Users\Admin\AppData\Local\Temp\hrl6884.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
\Windows\Temp\hrl6C3C.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
\Windows\Temp\hrl6C3C.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
memory/1620-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download