42020aad88c2b8d088098dc96942038880dbc4b0d27ab3f11257970e05b4152f

General

Target

qttqybrj_gr/天气预报.exe
Size

1.1MB
MD5

fbbab67d1c6fd1915f54de2964301c4c
SHA1

aa3490c59de9d9a0d84c5a931fbfb7612673af00
SHA256

fae9c3c792c7f64e9267f4fbe8fa51d691b199f867e545582849d0fbb326a258
SHA512

70064c5b6c65d79585c422e29ab72da9fb2cfec93b79a6f13c1430bbfa59af6ad8d9c73fcde620775b02ad802009a9fd1bb39dc52a75caeb8b7ed118b6ef3f3d
SSDEEP

24576:6giiPcEUiwv6Xe6Zuei/DbsKGc1xmdYu/4mP9vB4PVQLmM8:60UiC6XbwbIKx1A9P5mPVE

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/732-55-0x0000000000400000-0x00000000007F0000-memory.dmp	upx
behavioral1/memory/732-56-0x0000000000400000-0x00000000007F0000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

天气预报.exe

pid process

732 天气预报.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

天气预报.exe

pid	process
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe
732	天气预报.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

天气预报.exe

description pid process

Token: SeDebugPrivilege 732 天气预报.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

天气预报.exe

pid process

732 天气预报.exe

description	pid	process
Token: SeDebugPrivilege	732	天气预报.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

天气预报.exe

description	pid	process	target process
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 368	732	天气预报.exe	wininit.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 376	732	天气预报.exe	csrss.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 416	732	天气预报.exe	winlogon.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 460	732	天气预报.exe	services.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 476	732	天气预报.exe	lsass.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 484	732	天气预报.exe	lsm.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 580	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 656	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 740	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 788	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 832	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 832	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 832	732	天气预报.exe	svchost.exe
PID 732 wrote to memory of 832	732	天气预报.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:788

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1184

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1916

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1932

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\qttqybrj_gr\天气预报.exe
"C:\Users\Admin\AppData\Local\Temp\qttqybrj_gr\天气预报.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/732-55-0x0000000000400000-0x00000000007F0000-memory.dmp

Filesize
3.9MB

Download
memory/732-56-0x0000000000400000-0x00000000007F0000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads