3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d

General

Target

3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe
Size

152KB
MD5

808e8bb577939296df598aa31384a380
SHA1

f2a96cb0cd4957533b338b00a5894096b1482c6d
SHA256

3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d
SHA512

b816356d96e9ab7ce6b43088d54969a1994621bb9e6ac9e0fefae55be122188b2bbd517a762ee24281f8082fe6231f0f72ad7271adf9bc5344749bac7d0e1906
SSDEEP

3072:rDESGnwYM13C94Nk3sQdV777rVhblG25gaLX7:3ESGwYKC33sIV77nfblGO57

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1880-55-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral1/memory/1880-60-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral1/files/0x0009000000012318-62.dat	upx

Deletes itself 1 IoCs

pid	Process
1376	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.so11.cn/?sys"	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: 33	1556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1556	AUDIODG.EXE
Token: 33	1556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1556	AUDIODG.EXE
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe
Token: SeShutdownPrivilege	844	explorer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe
844	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 844	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	27
PID 1880 wrote to memory of 844	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	27
PID 1880 wrote to memory of 844	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	27
PID 1880 wrote to memory of 844	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	27
PID 1880 wrote to memory of 1376	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	29
PID 1880 wrote to memory of 1376	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	29
PID 1880 wrote to memory of 1376	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	29
PID 1880 wrote to memory of 1376	1880	3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe	29

C:\Users\Admin\AppData\Local\Temp\3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe
"C:\Users\Admin\AppData\Local\Temp\3b72414f3b4b47f75a1b6fcb1ac05d1027fb713a7a1ca6c0868c5582d3184d7d.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Modifies Installed Components in the registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  - Deletes itself
  PID:1376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
152KB

MD5
051f597fd2db56c40e1b808ac1c994fe

SHA1
a37d64d64f01360e6ce6d9bcbcd8ea6fd4f85428

SHA256
dbddf7a5e18ddf58b3b9c7c3c7a09ae2a30c8fef7af682021f3adfce09076af6

SHA512
7edcb9dce9cf7bd787d8d6422340499bcbb498ba8fc25ad0eade0452c85251b20b4925ea4d0d334de40729b473f4a78bc390c36ae6b07497036168fe4bbe266d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
d7c0defb7ed3f805e6481de818d9d7ed

SHA1
06746337088f3967eba1013c72badb8567d1146b

SHA256
1fac2972d420e0d034190f78e280a678a583f3ce29ef2b65631b0554a5e557b3

SHA512
e2c55a52c356002c5669291c542fd2fbcca1b8aec398c55653e74ed9608ce2f2eae17719c18b78f0b38209c2c06fe7609c76a037fc29fbe65656e69012223e8c

Download Submit
memory/844-58-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/844-64-0x0000000004410000-0x0000000004420000-memory.dmp

Filesize
64KB

Download
memory/1880-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1880-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1880-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads