Analysis
-
max time kernel
168s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 11:01
Behavioral task
behavioral1
Sample
Baidu_Com_90000215.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Baidu_Com_90000215.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ӛ-14.9.26.1.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ӛ-14.9.26.1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
QQ.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
QQ.url
Resource
win10v2004-20220812-en
General
-
Target
Baidu_Com_90000215.exe
-
Size
1.4MB
-
MD5
20dbd1541448c659e921ca523da62e8b
-
SHA1
59dfc6db7e026c5a27e89983d55be83aadf3a909
-
SHA256
0215531b7de01049eb626ab9c35f5e1264263bd11b120964a6ee34193e60561a
-
SHA512
ae4392893614f76bd2588cd9efa46dc6a5e14e3f2d23cf6da2d158f9bc70201a074558e8d103640c78a58d5dac5a84b1096e0a459c7917d6f8f5bb2adf71ff0b
-
SSDEEP
24576:aCfFgOHDg89bvfpETrWTVvqPldRv4dyB41Zk1J03xm4U5r1mqF+R3qo06QvuEjGn:RqOFbnaTrTTA041ZAKxFW8qFMan6Kudn
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
Baidu_Com_90000215.exepid process 924 Baidu_Com_90000215.exe 924 Baidu_Com_90000215.exe 924 Baidu_Com_90000215.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Baidu_Com_90000215.exepid process 924 Baidu_Com_90000215.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Baidu_Com_90000215.exepid process 924 Baidu_Com_90000215.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsfFAA3.tmp\BDMSkin.dllFilesize
1.3MB
MD5b540a866191f7fd20f5e6355bc2b094e
SHA1df01a0c011e88a1f860db41d474d3fe893f06082
SHA256ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6
SHA512e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331
-
C:\Users\Admin\AppData\Local\Temp\nsfFAA3.tmp\BDMSkin.dllFilesize
1.3MB
MD5b540a866191f7fd20f5e6355bc2b094e
SHA1df01a0c011e88a1f860db41d474d3fe893f06082
SHA256ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6
SHA512e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331
-
C:\Users\Admin\AppData\Local\Temp\nsfFAA3.tmp\tmpe_nxps.dllFilesize
636KB
MD5f0797dbe1af08f015da9b298d933bd43
SHA1653a424c60cc4795a75f2f661f869c4a60678976
SHA2563f3bfbfe70a4381d4e7f410163802a50ab21da0c01855944d52e07500bc519ce
SHA512de9a8ba4218a4155eb2cd6c37f857e41402caf2d439ae88d50e73bf6088c9d0151070f265462042d98caf1c4990093518e3d3a2d23f918340d70699118af3a99
-
memory/924-135-0x0000000003200000-0x0000000003343000-memory.dmpFilesize
1.3MB