5f60f13044bcadb3f399ace462c43293f6d407529111972a680a26d7da2f5f9b

General

Target

四季专用加速器.exe
Size

724KB
MD5

b2f073dfef7228c39c6616828bfecc96
SHA1

43b4a0025e4fadbc14889f195c6dde13d497cb2c
SHA256

59928ad4a8cd81943f03aa368f6a9cecd797b672726dfa9dd99efeaa251756b1
SHA512

eddb98c9ffec2163ecf4521f209aabee742d419a22e8ec8af502d5f64ecba215632960528d556597ea6a5bf5c207fb41e4d716d58927f6da994cc78d4704c17a
SSDEEP

12288:OT5864aY0sHGff7WE86sfaCtwlL0PCfR8+tiOtN/4PYY/UxtiT5K5gibV5f6U5Xk:OTwgk8SE86siCtwlL0PCp8yiOtN/AvUt

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/4632-137-0x0000000002520000-0x0000000002592000-memory.dmp	upx
behavioral4/memory/4632-138-0x0000000002520000-0x0000000002592000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral4/memory/4632-132-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral4/memory/4632-133-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect
behavioral4/memory/4632-136-0x0000000000400000-0x0000000000628000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2288	taskkill.exe
1204	taskkill.exe
3532	taskkill.exe
1660	taskkill.exe
2516	taskkill.exe
988	taskkill.exe
1108	taskkill.exe
4088	taskkill.exe
4620	taskkill.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

四季专用加速器.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?ktt659189"	四季专用加速器.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

四季专用加速器.exe

pid	process
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe
4632	四季专用加速器.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

四季专用加速器.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4632	四季专用加速器.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

四季专用加速器.exe

pid process

4632 四季专用加速器.exe
4632 四季专用加速器.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

四季专用加速器.exe

description	pid	process	target process
PID 4632 wrote to memory of 2516	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 2516	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 2516	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 2288	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 2288	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 2288	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 988	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 988	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 988	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1108	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1108	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1108	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1204	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1204	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1204	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4088	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4088	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4088	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 3532	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 3532	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 3532	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1660	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1660	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 1660	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4620	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4620	4632	四季专用加速器.exe	taskkill.exe
PID 4632 wrote to memory of 4620	4632	四季专用加速器.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\四季专用加速器.exe
"C:\Users\Admin\AppData\Local\Temp\四季专用加速器.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_1.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe_2.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TXPlatform.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TenSafe.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im DNFchina.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Tencentdl.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-141-0x0000000000000000-mapping.dmp

Download
memory/1108-142-0x0000000000000000-mapping.dmp

Download
memory/1204-143-0x0000000000000000-mapping.dmp

Download
memory/1660-146-0x0000000000000000-mapping.dmp

Download
memory/2288-140-0x0000000000000000-mapping.dmp

Download
memory/2516-139-0x0000000000000000-mapping.dmp

Download
memory/3532-145-0x0000000000000000-mapping.dmp

Download
memory/4088-144-0x0000000000000000-mapping.dmp

Download
memory/4620-147-0x0000000000000000-mapping.dmp

Download
memory/4632-132-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4632-138-0x0000000002520000-0x0000000002592000-memory.dmp

Filesize
456KB

Download
memory/4632-137-0x0000000002520000-0x0000000002592000-memory.dmp

Filesize
456KB

Download
memory/4632-136-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4632-133-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/4632-148-0x0000000002520000-0x0000000002592000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads