5f60f13044bcadb3f399ace462c43293f6d407529111972a680a26d7da2f5f9b

General

Target

四季专用加速器.exe
Size

724KB
MD5

b2f073dfef7228c39c6616828bfecc96
SHA1

43b4a0025e4fadbc14889f195c6dde13d497cb2c
SHA256

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1
SHA512

eddb98c9ffec2163ecf4521f209aabee742d419a22e8ec8af502d5f64ecba215632960528d556597ea6a5bf5c207fb41e4d716d58927f6da994cc78d4704c17a
SSDEEP

12288:OT5864aY0sHGff7WE86sfaCtwlL0PCfR8+tiOtN/4PYY/UxtiT5K5gibV5f6U5Xk:OTwgk8SE86siCtwlL0PCp8yiOtN/AvUt

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/1148-59-0x0000000000380000-0x00000000003F2000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral3/memory/1148-55-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral3/memory/1148-58-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral3/memory/1148-70-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1020	taskkill.exe
904	taskkill.exe
700	taskkill.exe
1256	taskkill.exe
1104	taskkill.exe
1060	taskkill.exe
2044	taskkill.exe
1288	taskkill.exe
944	taskkill.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

四季专用加速器.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?ktt659189"	四季专用加速器.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

四季专用加速器.exe

pid	process
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe
1148	四季专用加速器.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

四季专用加速器.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1148	四季专用加速器.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	700	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	1020	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

四季专用加速器.exe

pid process

1148 四季专用加速器.exe
1148 四季专用加速器.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

四季专用加速器.exe

description	pid	process	target process
PID 1148 wrote to memory of 1256	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1256	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1256	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1256	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1104	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1104	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1104	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1104	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1288	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1288	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1288	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1288	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1060	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1060	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1060	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1060	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 944	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 944	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 944	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 944	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 2044	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 2044	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 2044	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 2044	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1020	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1020	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1020	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 1020	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 904	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 904	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 904	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 904	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 700	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 700	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 700	1148	四季专用加速器.exe	taskkill.exe
PID 1148 wrote to memory of 700	1148	四季专用加速器.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\四季专用加速器.exe
"C:\Users\Admin\AppData\Local\Temp\四季专用加速器.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TXPlatform.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im DNFchina.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:700

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-69-0x0000000000000000-mapping.dmp

Download
memory/904-68-0x0000000000000000-mapping.dmp

Download
memory/944-65-0x0000000000000000-mapping.dmp

Download
memory/1020-67-0x0000000000000000-mapping.dmp

Download
memory/1060-64-0x0000000000000000-mapping.dmp

Download
memory/1104-62-0x0000000000000000-mapping.dmp

Download
memory/1148-58-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1148-60-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/1148-59-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/1148-55-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1148-70-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1148-71-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/1256-61-0x0000000000000000-mapping.dmp

Download
memory/1288-63-0x0000000000000000-mapping.dmp

Download
memory/2044-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads