79f857f2462f667565577cc6f48f3456bf7edc8df5d1f2c5ee879b91a40b8112

General

Target

CF天心简洁版全能工具Vc2.exe
Size

1.8MB
MD5

9a3aad8d873e636505269ded79d3c7d6
SHA1

063b45f33c3dc5a3d7b91f322fdc7da09f8fbb34
SHA256

5673aba18908dc2eca8ca9b32ea95f50245c5b6c992e1532268949aa08bb90d4
SHA512

b40f8f625ded22fd99610c15d3aa609647017604b5270f3cbae9439223c6b4e2d989c62f8e3d5b22a040a6543eb2aef79689a0a866cdd42570d4efadb8f8c96f
SSDEEP

49152:+pSiaMcB3SjvtzeItQPerQ6RmtMRDlfkNfv0qDK5:+pSppBiJzhQPe/Dlfk9v0qe5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Web YY.exe

pid process

5112 Web YY.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

CF天心简洁版全能工具Vc2.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CF天心简洁版全能工具Vc2.exe

pid	process
5112	Web YY.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CF天心简洁版全能工具Vc2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Web YY.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZDYY = "C:\\Windows\\Web YY.exe"	Web YY.exe

Drops file in System32 directory 1 IoCs

Processes:

CF天心简洁版全能工具Vc2.exe

description ioc process

File created C:\Windows\SysWOW64\Pastl8Phu.sys CF天心简洁版全能工具Vc2.exe
Drops file in Windows directory 1 IoCs

Processes:

CF天心简洁版全能工具Vc2.exe

description ioc process

File created C:\Windows\Web YY.exe CF天心简洁版全能工具Vc2.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 1264 WerFault.exe CF天心简洁版全能工具Vc2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Pastl8Phu.sys	CF天心简洁版全能工具Vc2.exe

description	ioc	process
File created	C:\Windows\Web YY.exe	CF天心简洁版全能工具Vc2.exe

pid	pid_target	process	target process
4808	1264	WerFault.exe	CF天心简洁版全能工具Vc2.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

Web YY.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com	Web YY.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Web YY.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com	Web YY.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com\NumberOfSubdomains = "1"	Web YY.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid process

660
660
660
660
660
660

pid	process
660
660
660
660
660
660

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

CF天心简洁版全能工具Vc2.exeWeb YY.exe

pid	process
1264	CF天心简洁版全能工具Vc2.exe
1264	CF天心简洁版全能工具Vc2.exe
5112	Web YY.exe
5112	Web YY.exe
5112	Web YY.exe
5112	Web YY.exe
1264	CF天心简洁版全能工具Vc2.exe
1264	CF天心简洁版全能工具Vc2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

CF天心简洁版全能工具Vc2.exe

description	pid	process	target process
PID 1264 wrote to memory of 5112	1264	CF天心简洁版全能工具Vc2.exe	Web YY.exe
PID 1264 wrote to memory of 5112	1264	CF天心简洁版全能工具Vc2.exe	Web YY.exe
PID 1264 wrote to memory of 5112	1264	CF天心简洁版全能工具Vc2.exe	Web YY.exe

C:\Users\Admin\AppData\Local\Temp\CF天心简洁版全能工具Vc2.exe
"C:\Users\Admin\AppData\Local\Temp\CF天心简洁版全能工具Vc2.exe"
1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\Web YY.exe
"C:\Windows\Web YY.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 892
2⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1264 -ip 1264
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Web YY.exe

Filesize
628KB

MD5
855b7afef231bf302ba464a083510d45

SHA1
17e3617ac8ba994119e086f3192f51f5dacbefe1

SHA256
6ab1bae01323ae3fe83fc5d01404dedbcb03829e92d6968ecf3095e132962e1f

SHA512
a8f37497af9fb6828c9fea9e4ce70776c06c3d9a1b3f07256e15ddd0632a61691c5d3ce87a482d601357e9652f86f061532ff94fce7d5d1b44fae61f36609b02

Download Submit
C:\Windows\Web YY.exe

Filesize
628KB

MD5
855b7afef231bf302ba464a083510d45

SHA1
17e3617ac8ba994119e086f3192f51f5dacbefe1

SHA256
6ab1bae01323ae3fe83fc5d01404dedbcb03829e92d6968ecf3095e132962e1f

SHA512
a8f37497af9fb6828c9fea9e4ce70776c06c3d9a1b3f07256e15ddd0632a61691c5d3ce87a482d601357e9652f86f061532ff94fce7d5d1b44fae61f36609b02

Download Submit
memory/1264-132-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-133-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-134-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-135-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-136-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-138-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-139-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-140-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1264-144-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/5112-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads