Analysis
-
max time kernel
207s -
max time network
280s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 18:59
General
-
Target
9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe
-
Size
1.3MB
-
MD5
0ebcb9350873fd1075e4953c7d628008
-
SHA1
ff610acbba1118fc945a67689fe52cfbe72090b4
-
SHA256
9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2
-
SHA512
b8ab30e850114d9e92616aaec1c1a36cbffab5c04d94ec04fb3b364f1f3e54b55c475ae0c2cc20647d35d9b91898e1cc97fb70be5b24f79ff33ed115f12bdde7
-
SSDEEP
24576:GZjO+TAqzACKyMyKiAgPcVgiTybPo1YuOZNWmO0u5cc9kYxubPaGNMy0yNSF183n:dR0P2CM15r5cc9xlGNMyZNSFsqja
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 17 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe"C:\Users\Admin\AppData\Local\Temp\9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PBMEH.tmp\9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.tmp"C:\Users\Admin\AppData\Local\Temp\is-PBMEH.tmp\9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.tmp" /SL5="$90122,1062527,56832,C:\Users\Admin\AppData\Local\Temp\9eaede27218850b4c80c03d623126f02f03e3746f4cba06fc96934ab43a25db2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Éú»¯Õ½³¡WOZÁìÓòÌåÑé·þ¸¨ÖúSP3Ãâ·Ñ°æ\WOZÁìÓòÌåÑé·þ¸¨Öúsp03.exe"C:\Users\Admin\Desktop\Éú»¯Õ½³¡WOZÁìÓòÌåÑé·þ¸¨ÖúSP3Ãâ·Ñ°æ\WOZÁìÓòÌåÑé·þ¸¨Öúsp03.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.110wg.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-S1JQD.tmp\HomePageSet.exe"C:\Users\Admin\AppData\Local\Temp\is-S1JQD.tmp\HomePageSet.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD5e767684b8a649a41164807d953bc516e
SHA12330b2e1f540f8789dc8a421c368fca6fd371567
SHA25640fcb9aee3e143038883dd81f532f25c444429f4b6d67f0d1509284fade8f1b6
SHA512dd01d892eba9653be98593a396db9c3377f7a6363d91bee6236cc5c6d8cffea6761e42693c67baf402da209fd2af2cf17064f3ad57046578b63d2d267ea30b8c
-
Filesize
701KB
MD5e767684b8a649a41164807d953bc516e
SHA12330b2e1f540f8789dc8a421c368fca6fd371567
SHA25640fcb9aee3e143038883dd81f532f25c444429f4b6d67f0d1509284fade8f1b6
SHA512dd01d892eba9653be98593a396db9c3377f7a6363d91bee6236cc5c6d8cffea6761e42693c67baf402da209fd2af2cf17064f3ad57046578b63d2d267ea30b8c
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
601B
MD524c2c505407073e76e4e2df9b3d648e1
SHA158a6d9148f7b82fab3b343b4292e89d1a807b179
SHA25671bed8592908351f311dd30cf574014b15c1a6674783a01f70cbc6e10be0f31b
SHA5129949449b279ac9c487b152ad68931cbbc44be34b67c93e4edb5776bc12c8e86605b775402602f73ffe7d287ae129ed30f6a5232e85a6f0bc07ab089251da666b
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
701KB
MD5e767684b8a649a41164807d953bc516e
SHA12330b2e1f540f8789dc8a421c368fca6fd371567
SHA25640fcb9aee3e143038883dd81f532f25c444429f4b6d67f0d1509284fade8f1b6
SHA512dd01d892eba9653be98593a396db9c3377f7a6363d91bee6236cc5c6d8cffea6761e42693c67baf402da209fd2af2cf17064f3ad57046578b63d2d267ea30b8c
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
382KB
MD5fd3e4a82c738c59bb151560a74b53935
SHA1c6d3a5edaa773bb9ac7d4ab5261d1656a284f462
SHA2568d35cb362f6ecd8b3feee42c7ad3246f12fc93d05278924c68cbe3c51201196f
SHA5128e582b9acd29f82fc6c48f78286edc9c4cee3a955dc94226ff1aad5d5332187924935a358c62faa1d63d8d7397d58d423755196bfc6538c0892719032c41516b
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
1.0MB
MD556d52d6a04e31cf434e56b39368aed0e
SHA1a8bfb794cfc4c7d1a1b3cd0fb1fad69dc2e64594
SHA256514c71204d3c176ea33b23117fa77de2dbdfeb72c97301dc228b2b00b3dcd0f9
SHA512c438212f17fddb57058b5ad78e004cfb1b948e089b5ce076448d5930f75d5137b2c7ea8a9f2a8e486cf04482597ff24741715e965125f3bd1022d179923e7cc3
-
Filesize
708KB
MD540c7e2284f750fd685baf5cca1f819ef
SHA1af3e77fe36063eb3a4de4ac612ad554efb7b336f
SHA2566166142f91df2bf81845dc6dc9e3826596d1d8247dd8dc27ee62a034b0b41220
SHA51298bc4c1ca4fa892ff610c35f2224eafa1a3126e3ab2b809f3b9a5cf6d16a242a1f1db5bcf56b5cbdbb2a2849605ab24ddd24a6574aad6e3a1fafd9a1026c7810
-
Filesize
708KB
MD540c7e2284f750fd685baf5cca1f819ef
SHA1af3e77fe36063eb3a4de4ac612ad554efb7b336f
SHA2566166142f91df2bf81845dc6dc9e3826596d1d8247dd8dc27ee62a034b0b41220
SHA51298bc4c1ca4fa892ff610c35f2224eafa1a3126e3ab2b809f3b9a5cf6d16a242a1f1db5bcf56b5cbdbb2a2849605ab24ddd24a6574aad6e3a1fafd9a1026c7810
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
-
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-