1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3

Analysis

max time kernel
79s
max time network
96s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe
Size

1.2MB
MD5

822dd46ca0b5d2ca0bffece58e2a0bcd
SHA1

6ebfddd3db40b70cb81f952ed10455abcd2b0e02
SHA256

1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3
SHA512

23dc365ba77056027f8d387ff0ddfe38763c46b6c3dd647cd8b4fc8091bdfbd1671468f3afd8a6b1f24df2f1b50afd163b521cdabca25a359218797859ef6d83
SSDEEP

24576:3Sev5VtpRf4tFmM1Dcvj3E8FgXqQmX+KK:3SY3fO4suEHLmuKK

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath = "t%\\sy"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath = "t%\\sy"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 1 IoCs

pid	Process
1880	netstatkyo.exe

Sets file execution options in registry 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMON.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswupdsv.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvPreScan.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSTART.EXE\debugger = "TASKMAN.EXE"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashserv.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.EXE\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSTART.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvPreScan.exe\debugger = "TASKMAN.EXE"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.EXE\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashwebsv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashwebsv.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.EXE\debugger = "TASKMAN.EXE"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMON.EXE\debugger = "TASKMAN.EXE"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswupdsv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\debugger = "TASKMAN.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashserv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe\debugger = "TASKMAN.EXE"	regedit.exe

Sets file to hidden 1 TTPs 17 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
896	attrib.exe
2008	attrib.exe
112	attrib.exe
1616	attrib.exe
1624	attrib.exe
1628	attrib.exe
1720	attrib.exe
1984	attrib.exe
1512	attrib.exe
1940	attrib.exe
1556	attrib.exe
1936	attrib.exe
956	attrib.exe
1284	attrib.exe
1408	attrib.exe
1980	attrib.exe
1044	attrib.exe

Sets service image path in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\W32Time\ImagePath = "C:\\D"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath = "t%\\sy"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\W32Time\ImagePath = "C:\\D"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath = "t%\\sy"	regedit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 1 IoCs

pid	Process
1696	cmd.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cacls.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\netstatkyo.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sethc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\compmgmt.msc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ftpkyo.exe	cmd.exe
File created	C:\Windows\SysWOW64\sethc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sethc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\netstatkyo.exe	cmd.exe
File created	C:\Windows\SysWOW64\dllcache\sethc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\compmgmtkyo.msc	attrib.exe
File created	C:\Windows\SysWOW64\compmgmtkyo.msc	cmd.exe
File created	C:\Windows\SysWOW64\ftpkyo.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ftpkyo.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\netstatkyo.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\compmgmtkyo.msc	cmd.exe
File created	C:\Windows\SysWOW64\compmgmt.msc	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\usershttplogs.ini	WScript.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1328	sc.exe
1792	sc.exe
1904	sc.exe
1568	sc.exe
872	sc.exe
1524	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
896	tasklist.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1796	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
568	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\Main	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "»¶Ó\u00ad¼ÓÈë°Ù¶ÈÀ¶É«ÓîÖæIEÎ¢ÈíÏµÍ³½»Á÷Èº.ÈººÅ:41061527"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\Main	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "»¶Ó\u00ad¼ÓÈë°Ù¶ÈÀ¶É«ÓîÖæIEÎ¢ÈíÏµÍ³½»Á÷Èº.ÈººÅ:41061527"	regedit.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "ÏµÍ³ÎÄµµ±¸·ÝÎÄ¼þ¼Ð"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "ÏµÍ³ÎÄµµ±¸·ÝÎÄ¼þ¼Ð"	regedit.exe

Runs .reg file with regedit 3 IoCs

pid	Process
1172	regedit.exe
1964	regedit.exe
1016	regedit.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	tasklist.exe
Token: SeDebugPrivilege	1880	netstatkyo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1696	1736	1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe	27
PID 1736 wrote to memory of 1696	1736	1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe	27
PID 1736 wrote to memory of 1696	1736	1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe	27
PID 1736 wrote to memory of 1696	1736	1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe	27
PID 1696 wrote to memory of 1780	1696	cmd.exe	29
PID 1696 wrote to memory of 1780	1696	cmd.exe	29
PID 1696 wrote to memory of 1780	1696	cmd.exe	29
PID 1696 wrote to memory of 1780	1696	cmd.exe	29
PID 1696 wrote to memory of 1420	1696	cmd.exe	30
PID 1696 wrote to memory of 1420	1696	cmd.exe	30
PID 1696 wrote to memory of 1420	1696	cmd.exe	30
PID 1696 wrote to memory of 1420	1696	cmd.exe	30
PID 1696 wrote to memory of 1212	1696	cmd.exe	31
PID 1696 wrote to memory of 1212	1696	cmd.exe	31
PID 1696 wrote to memory of 1212	1696	cmd.exe	31
PID 1696 wrote to memory of 1212	1696	cmd.exe	31
PID 1696 wrote to memory of 1768	1696	cmd.exe	32
PID 1696 wrote to memory of 1768	1696	cmd.exe	32
PID 1696 wrote to memory of 1768	1696	cmd.exe	32
PID 1696 wrote to memory of 1768	1696	cmd.exe	32
PID 1696 wrote to memory of 1284	1696	cmd.exe	33
PID 1696 wrote to memory of 1284	1696	cmd.exe	33
PID 1696 wrote to memory of 1284	1696	cmd.exe	33
PID 1696 wrote to memory of 1284	1696	cmd.exe	33
PID 1696 wrote to memory of 2008	1696	cmd.exe	34
PID 1696 wrote to memory of 2008	1696	cmd.exe	34
PID 1696 wrote to memory of 2008	1696	cmd.exe	34
PID 1696 wrote to memory of 2008	1696	cmd.exe	34
PID 1696 wrote to memory of 1408	1696	cmd.exe	35
PID 1696 wrote to memory of 1408	1696	cmd.exe	35
PID 1696 wrote to memory of 1408	1696	cmd.exe	35
PID 1696 wrote to memory of 1408	1696	cmd.exe	35
PID 1696 wrote to memory of 1980	1696	cmd.exe	36
PID 1696 wrote to memory of 1980	1696	cmd.exe	36
PID 1696 wrote to memory of 1980	1696	cmd.exe	36
PID 1696 wrote to memory of 1980	1696	cmd.exe	36
PID 1696 wrote to memory of 896	1696	cmd.exe	37
PID 1696 wrote to memory of 896	1696	cmd.exe	37
PID 1696 wrote to memory of 896	1696	cmd.exe	37
PID 1696 wrote to memory of 896	1696	cmd.exe	37
PID 1696 wrote to memory of 1796	1696	cmd.exe	39
PID 1696 wrote to memory of 1796	1696	cmd.exe	39
PID 1696 wrote to memory of 1796	1696	cmd.exe	39
PID 1696 wrote to memory of 1796	1696	cmd.exe	39
PID 1696 wrote to memory of 872	1696	cmd.exe	40
PID 1696 wrote to memory of 872	1696	cmd.exe	40
PID 1696 wrote to memory of 872	1696	cmd.exe	40
PID 1696 wrote to memory of 872	1696	cmd.exe	40
PID 1696 wrote to memory of 1700	1696	cmd.exe	41
PID 1696 wrote to memory of 1700	1696	cmd.exe	41
PID 1696 wrote to memory of 1700	1696	cmd.exe	41
PID 1696 wrote to memory of 1700	1696	cmd.exe	41
PID 1696 wrote to memory of 1248	1696	cmd.exe	42
PID 1696 wrote to memory of 1248	1696	cmd.exe	42
PID 1696 wrote to memory of 1248	1696	cmd.exe	42
PID 1696 wrote to memory of 1248	1696	cmd.exe	42
PID 1696 wrote to memory of 1836	1696	cmd.exe	43
PID 1696 wrote to memory of 1836	1696	cmd.exe	43
PID 1696 wrote to memory of 1836	1696	cmd.exe	43
PID 1696 wrote to memory of 1836	1696	cmd.exe	43
PID 1696 wrote to memory of 1380	1696	cmd.exe	44
PID 1696 wrote to memory of 1380	1696	cmd.exe	44
PID 1696 wrote to memory of 1380	1696	cmd.exe	44
PID 1696 wrote to memory of 1380	1696	cmd.exe	44

Views/modifies file attributes 1 TTPs 26 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1984	attrib.exe
1616	attrib.exe
1720	attrib.exe
1556	attrib.exe
1396	attrib.exe
1048	attrib.exe
1512	attrib.exe
1940	attrib.exe
2008	attrib.exe
1408	attrib.exe
1980	attrib.exe
1268	attrib.exe
1060	attrib.exe
1624	attrib.exe
956	attrib.exe
1564	attrib.exe
1044	attrib.exe
1556	attrib.exe
1628	attrib.exe
1936	attrib.exe
896	attrib.exe
1976	attrib.exe
1284	attrib.exe
112	attrib.exe
1984	attrib.exe
1208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe
"C:\Users\Admin\AppData\Local\Temp\1c87c2b61567f8e5763bdea57d3628147e5db429cec45dffb7e835bf81d39ac3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Documents and Settings\All Users\Application Data\baiducoma.bat""
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy *date.exe D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy *date.scr D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:1768
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1284
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "C:\Documents and Settings\All Users\Application Data\baiducoma.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2008
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Documents and Settings\All Users\Application Data"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1408
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Program Files\Common Files\Microsoft Shared\Web Folders"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1980
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "ekrn.exe safeboxTray.exe nod32krn.exe kwatch.exe shstat.exe Client.exe ashserv.exe" pid1.txt
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc delete knlps
    3⤵
    - Launches sc.exe
    PID:872
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "CCenter.exe services.exe 360tray.exe KVMonXP.kxp RSTray.exe RfwMain.exe 8date.exe" pid1.txt
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ComputerName" /v "ComputerName" /t reg_sz /d └╢╙ε╚║:41061527 /f
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ActiveComputerName" /v "ComputerName" /t reg_sz /d └╢╙ε╚║:41061527 /f
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters" /v "NV Hostname" /t reg_sz /d └╢╙ε╚║:41061527 /f
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters" /v Hostname /t reg_sz /d └╢╙ε╚║:41061527 /f
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Micsofoffice1.exe "Microsoft\Micsofoffice1.exe" /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Micsofoffice2.rar "Microsoft\Micsofoffice2.rar" /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    SC create Microsoftmanager binPath= "C:\Documents and Settings\All Users\Application Data\Microsoft\Micsofoffice1.exe" Start= auto displayname= "Microsoftnetwork gervice" type= own
    3⤵
    - Launches sc.exe
    PID:1524
- - C:\Windows\SysWOW64\sc.exe
    sc config Microsoftmanager start= auto
    3⤵
    - Launches sc.exe
    PID:1328
- - C:\Windows\SysWOW64\sc.exe
    SC description Microsoftmanager "╬¬╣▄└φ║═╬¼╗ñ╘┌╝╞╦π╗·─┌NTFS┤┼┼╠╬─╝■╓«╝Σ╡─╧╡═│╩²╛▌┐Γ,╧√╧ó╢╙┴╨,╬─╝■╧╡═│╡╚╫╩╘┤╣▄└φ╞≈╡─╩┬╬±╠ß╣⌐╓º│╓.╜╧╡═░µ▒╛╡─▓┘╫≈╧╡═│╘≥▓╗╗ß╖ó╔·╒Γ╨⌐╩┬╬±.╚τ╣√╜√╙├┤╦╖■╬±,╚╬║╬╥└└╡┤╦╖■╬±╡─╞Σ╦√╖■╬±╜½╬▐╖¿╞⌠╢»."
    3⤵
    - Launches sc.exe
    PID:1792
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "Microsoft\Micsofoffice2.rar"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1556
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "Microsoft\Micsofoffice1.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1984
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s BaiDuhi.reg
    3⤵
    - Modifies security service
    - Modifies visiblity of hidden/system files in Explorer
    - Sets service image path in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Runs .reg file with regedit
    PID:1172
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr
    3⤵
    - Views/modifies file attributes
    PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:840
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr "D:\My documents\╬╥╡─╥⌠└╓║══╝╞¼╩╒▓╪date.SCR" /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:576
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "D:\My documents\╬╥╡─╥⌠└╓║══╝╞¼╩╒▓╪date.scr" D:\Windows╧╡═│╔∙╥⌠╬─╡╡▒╕╖▌╬─╝■╝╨date.SCR /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo f"
    3⤵
    PID:620
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "D:\My documents\╬╥╡─╥⌠└╓║══╝╞¼╩╒▓╪date.scr" E:\╤█╛ª░╤╤╢║┼┤½╕°─π╡─╨─┴Θ╩╟┴φ╥╗╓╓┐╒╞°-╗╢╙¡╝╙╚δ░┘╢╚└╢╔½╙ε╓µ╛ⁿ═┼╫▄╚║║┼41061527\Windows▒ú╗ñ╬─╡╡▒╕╖▌╬─╝■╝╨date.SCR /q /h /r /y
    3⤵
    - Enumerates system info in registry
    PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\cacls.exe
    cacls E:\╤█╛ª░╤╤╢║┼┤½╕°─π╡─╨─┴Θ╩╟┴φ╥╗╓╓┐╒╞°-╗╢╙¡╝╙╚δ░┘╢╚└╢╔½╙ε╓µ╛ⁿ═┼╫▄╚║║┼41061527 /D GRXNNIIE
    3⤵
    - Enumerates connected drives
    PID:1364
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s D:\Windows╧╡═│╔∙╥⌠╬─╡╡▒╕╖▌╬─╝■╝╨date.SCR
    3⤵
    - Views/modifies file attributes
    PID:1060
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h D:\Windows╟²╢»│╠╨≥▒╕╖▌╬─╡╡╬─╝■.scr
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:112
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s "D:\My documents\╬╥╡─╥⌠└╓║══╝╞¼╩╒▓╪date.scr"
    3⤵
    - Views/modifies file attributes
    PID:1048
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Windows\system32\Microsoft
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1512
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h Microsoft
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1616
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil fsinfo drives
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\find.exe
    find /v ""
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil fsinfo drivetype Drives:
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "╥╞╢»" 200.txt
    3⤵
    PID:1768
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "╥╞╢»" 200.txt
      4⤵
      PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "╥╞╢»" 200.txt
    3⤵
    PID:648
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "╥╞╢»" 200.txt
      4⤵
      PID:1004
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\system32\ftpkyo.exe
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1940
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "C:\Documents and Settings\All Users\Application Data\ftp.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1624
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\system32\tftpkyo.exe
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\system32\netstatkyo.exe
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1720
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\system32\compmgmtkyo.msc
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1936
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\system32\sethc.exe
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:896
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1796
- - C:\Windows\SysWOW64\netstatkyo.exe
    netstatkyo.exe -an
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:568
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\system32\ftp.exe
    3⤵
    - Views/modifies file attributes
    PID:1556
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\system32\ftpkyo.exe
    3⤵
    - Views/modifies file attributes
    PID:1984
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\system32\tftp.exe
    3⤵
    - Views/modifies file attributes
    PID:1396
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\system32\tftpkyo.exe
    3⤵
    - Views/modifies file attributes
    PID:1976
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s BaiDuhi.reg
    3⤵
    - Modifies security service
    - Modifies visiblity of hidden/system files in Explorer
    - Sets service image path in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Runs .reg file with regedit
    PID:1964
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\GRXNNIIE.txt
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type C:\BOOT.INI"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\find.exe
    find /i "XP"
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s Image.reg
    3⤵
    - Sets file execution options in registry
    - Runs .reg file with regedit
    PID:1016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\date.txt
    3⤵
    - Views/modifies file attributes
    PID:1564
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Documents and Settings\All Users\alluserslog.ini"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc config Browser start= disabled
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc config lanmanserver start= disabled
    3⤵
    - Launches sc.exe
    PID:1568
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Documents and Settings\All Users\Application Data\Microsoft\chekip.vbs"
    3⤵
    - Drops file in Windows directory
    PID:112
- - C:\Windows\SysWOW64\net.exe
    net stop Browser /y
    3⤵
    PID:1048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Browser /y
      4⤵
      PID:612
- - C:\Windows\SysWOW64\net.exe
    net stop lanmanworkstation /y
    3⤵
    PID:1936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop lanmanworkstation /y
      4⤵
      PID:772
- - C:\Windows\SysWOW64\net.exe
    net stop lanmanserver /y
    3⤵
    PID:1796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop lanmanserver /y
      4⤵
      PID:764
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Documents and Settings\All Users\Application Data\baiducoma.bat"
    3⤵
    - Views/modifies file attributes
    PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\All Users\Application Data\BaiDuhi.reg

Filesize
1KB

MD5
1350b2336d9210a3e11333a81e3ea33a

SHA1
c9ffa4332660e8821612640eb1cb7f9d717b68bf

SHA256
652cc677a43547d6008c104196c5361d1c4fe259ff64dab501391632b30d4337

SHA512
df8464c3a236d200c6da3cdbcaf98cfe10046b5477091569ccab45d80766204e287864ed62a572afd9772cf0eb33370bcf8e7a69eea1b2b68296163874741291

Download Submit
C:\Documents and Settings\All Users\Application Data\Image.reg

Filesize
2KB

MD5
c615e428272dae1eaafb51e8300803a9

SHA1
755c4f97eebc984a89bdc0e8c17afdf65e029e17

SHA256
a0c056d8a0a610311f63bd26e4f63cad569d409589b9c6429da19fdf3af48b93

SHA512
32fab45dc411a4f4f7690c472d4902f1fdfa6ac9e0f24f7fb88d7e709cb27b10d03547144c3dbb2f4b5085e3866a19df63d090a165999faec3cb89080f3dfeb9

Download Submit
C:\Documents and Settings\All Users\Application Data\Microsoft\chekip.vbs

Filesize
379B

MD5
a28df3b71f64ee3dfea1b6312b65e37d

SHA1
4100772e2240129ad6eca9bc0c02737df4041445

SHA256
db45839c2dc969d6c50153db13e8b95348ad9688ca25e4273cda769af3be0229

SHA512
3ead0ceb33e977a17929e2b691c932173aa7d6288caf2baf124757f4fa271b63f7e914ad223afd9974ab524301a14d9ee36d469a1addc78c6bbfee050228b071

Download Submit
C:\Documents and Settings\All Users\Application Data\baiducoma.bat

Filesize
24KB

MD5
b5d266afb1cba8474f1e59b41561526e

SHA1
588a88e72cfe2b3551f9852b7a2f6f19a102e708

SHA256
24c1514acdd74dab641e49b56a4c9061d77696d83b7149eae958ec1e1dec961b

SHA512
ad4558887f05ed1ed3f9bb70022fa4aee925d7707aed69a15fdd008471243af88b245fba6a68bdbf22ef05ccdf60f362883ce85c71077ba232413a7d6812c7d2

Download Submit
C:\Windows\SysWOW64\compmgmtkyo.msc

Filesize
110KB

MD5
f04c119c159670c9271623454bec3254

SHA1
1f42aed72c659b75b9e5a2ff1e284c0649765c3c

SHA256
2456bd374082d03520d844b922ad58ff1e3850c0dc0c3683c9c54d4f538f2c19

SHA512
9d021717151da9ddfbe8fab555334402c5083b6be678683c180ed726d1de483390aa197473cefef21924cc80dc8fe9d680b1634393f03b72e0c38bbee45995bb

Download Submit
C:\Windows\SysWOW64\ftpkyo.exe

Filesize
41KB

MD5
9996103f8a650bdb3586c9aae1101912

SHA1
e2e444f527dc7d20732bfec10055de916647565f

SHA256
74e674254bda1a062eff7042db819ac71496d00e0e1854c6d3809163685ff687

SHA512
dd2938965f0edac5006904b568a4d27cc47d2a21f8cee72dcc4744b4f74d830ea47e711f7690aa39942569915e3fc29dd12cd3fb310fd1395e999a002152a616

Download Submit
C:\Windows\SysWOW64\netstatkyo.exe

Filesize
26KB

MD5
32297bb17e6ec700d0fc869f9acaf561

SHA1
f08d57dd80aeddd7645cbdf27e5af5edf99c1f46

SHA256
986f524f38b973531002dceb17414bf8c691b60fb0ea2e4c53c3c7bd3f9ee54e

SHA512
262f69525337c9a82c7e7b53889f30f9e5d5c1889c6f7b8295ffad8177d74c5e3dfd68f301cedaf648a4a3845bd765471d38d0ac1a9b9bd3fddf2f26ce8286a1

Download Submit
C:\Windows\SysWOW64\netstatkyo.exe

Filesize
26KB

MD5
32297bb17e6ec700d0fc869f9acaf561

SHA1
f08d57dd80aeddd7645cbdf27e5af5edf99c1f46

SHA256
986f524f38b973531002dceb17414bf8c691b60fb0ea2e4c53c3c7bd3f9ee54e

SHA512
262f69525337c9a82c7e7b53889f30f9e5d5c1889c6f7b8295ffad8177d74c5e3dfd68f301cedaf648a4a3845bd765471d38d0ac1a9b9bd3fddf2f26ce8286a1

Download Submit
\Windows\SysWOW64\netstatkyo.exe

Filesize
26KB

MD5
32297bb17e6ec700d0fc869f9acaf561

SHA1
f08d57dd80aeddd7645cbdf27e5af5edf99c1f46

SHA256
986f524f38b973531002dceb17414bf8c691b60fb0ea2e4c53c3c7bd3f9ee54e

SHA512
262f69525337c9a82c7e7b53889f30f9e5d5c1889c6f7b8295ffad8177d74c5e3dfd68f301cedaf648a4a3845bd765471d38d0ac1a9b9bd3fddf2f26ce8286a1

Download Submit
memory/1172-85-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1736-59-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/1736-60-0x0000000003250000-0x0000000003253000-memory.dmp

Filesize
12KB

Download
memory/1736-136-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/1736-58-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads