Analysis
-
max time kernel
19s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:04
Behavioral task
behavioral1
Sample
DNF四季10.25A.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
DNF四季10.25A.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
四季专用加速器.exe
Resource
win7-20220812-en
General
-
Target
DNF四季10.25A.exe
-
Size
852KB
-
MD5
f70c1e265fac675c240454c8d7758562
-
SHA1
a4a4f7d54122d643498f851933fb3710139b2ae7
-
SHA256
bc9346d9bdeaeb770f24f434dd735a19ac277376e5539e7007df001f0bb92453
-
SHA512
0ba3d3c955bfc4fb8a3d3f147a6e6efb1beefd197877bc82b57de5f36ff6c51ed00c50834e0bc90157c07ea733c3deb6d8ade7b6c09c7789421dd736a090ee9c
-
SSDEEP
24576:0Tiszm0kMoFSds2xbXdwaD3HklNFK9aPg9qsGXyB5eApk+:0E0kjFSds2xbXdw43HqFK9aP+9G1Ab
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1236-59-0x0000000000750000-0x00000000007C2000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/1236-55-0x0000000000400000-0x000000000068C000-memory.dmp vmprotect behavioral1/memory/1236-58-0x0000000000400000-0x000000000068C000-memory.dmp vmprotect behavioral1/memory/1236-70-0x0000000000400000-0x000000000068C000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 9 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 676 taskkill.exe 1972 taskkill.exe 1648 taskkill.exe 1284 taskkill.exe 1380 taskkill.exe 108 taskkill.exe 1912 taskkill.exe 652 taskkill.exe 576 taskkill.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
DNF四季10.25A.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?ktt659189" DNF四季10.25A.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
DNF四季10.25A.exepid process 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
DNF四季10.25A.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1236 DNF四季10.25A.exe Token: SeDebugPrivilege 676 taskkill.exe Token: SeDebugPrivilege 1912 taskkill.exe Token: SeDebugPrivilege 108 taskkill.exe Token: SeDebugPrivilege 652 taskkill.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 1284 taskkill.exe Token: SeDebugPrivilege 1648 taskkill.exe Token: SeDebugPrivilege 1380 taskkill.exe Token: SeDebugPrivilege 576 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
DNF四季10.25A.exepid process 1236 DNF四季10.25A.exe 1236 DNF四季10.25A.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
DNF四季10.25A.exedescription pid process target process PID 1236 wrote to memory of 576 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 576 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 576 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 576 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1912 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1912 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1912 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1912 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 652 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 652 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 652 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 652 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 676 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 676 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 676 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 676 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1972 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1972 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1972 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1972 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1648 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1648 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1648 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1648 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1284 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1284 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1284 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1284 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1380 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1380 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1380 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 1380 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 108 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 108 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 108 1236 DNF四季10.25A.exe taskkill.exe PID 1236 wrote to memory of 108 1236 DNF四季10.25A.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DNF四季10.25A.exe"C:\Users\Admin\AppData\Local\Temp\DNF四季10.25A.exe"1⤵
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TenSafe.exe_12⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:576 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TenSafe.exe_22⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TenSafe.exe_1.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TenSafe.exe_2.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TXPlatform.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Tencentdl.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TenSafe.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1284 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im DNFchina.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Tencentdl.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-68-0x0000000000000000-mapping.dmp
-
memory/576-60-0x0000000000000000-mapping.dmp
-
memory/652-62-0x0000000000000000-mapping.dmp
-
memory/676-63-0x0000000000000000-mapping.dmp
-
memory/1236-59-0x0000000000750000-0x00000000007C2000-memory.dmpFilesize
456KB
-
memory/1236-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1236-58-0x0000000000400000-0x000000000068C000-memory.dmpFilesize
2.5MB
-
memory/1236-55-0x0000000000400000-0x000000000068C000-memory.dmpFilesize
2.5MB
-
memory/1236-69-0x0000000000750000-0x00000000007C2000-memory.dmpFilesize
456KB
-
memory/1236-70-0x0000000000400000-0x000000000068C000-memory.dmpFilesize
2.5MB
-
memory/1284-66-0x0000000000000000-mapping.dmp
-
memory/1380-67-0x0000000000000000-mapping.dmp
-
memory/1648-65-0x0000000000000000-mapping.dmp
-
memory/1912-61-0x0000000000000000-mapping.dmp
-
memory/1972-64-0x0000000000000000-mapping.dmp