Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25-11-2022 22:58
General
-
Target
yhzj.exe
-
Size
50KB
-
MD5
88b39d09645aa838387fc95670aa36c6
-
SHA1
e16f50586abf4e6857c8537b23ddd0a45a9a25a2
-
SHA256
53d880178a910f1ed651139ce5c869dd215e2f309718a7295612131b608bcab6
-
SHA512
6c74f37c961782ceb6da599fd8ee64432c9f8cfa19db17827bf0955224b3d2c2dc9ffc7188984915e57d436d083e2acdc28e8c06e97941c127766a3bd1174f63
-
SSDEEP
768:Ka1aKW+gwxMvEGiCuBEPKTBZGgV6zBIx7QEHzEaUxCCKsPa4TaDIv8dP:Khxo4E3196zMpHwACKG+I8P
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 20 IoCs
-
Suspicious use of SetWindowsHookEx 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yhzj.exe"C:\Users\Admin\AppData\Local\Temp\yhzj.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-54-0x0000000000400000-0x000000000042A499-memory.dmpFilesize
169KB
-
memory/784-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/784-57-0x0000000000400000-0x000000000042A499-memory.dmpFilesize
169KB
-
memory/784-58-0x0000000000780000-0x00000000007B6000-memory.dmpFilesize
216KB
-
memory/784-59-0x0000000002030000-0x0000000002078000-memory.dmpFilesize
288KB
-
memory/784-60-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/784-63-0x0000000000780000-0x00000000007B6000-memory.dmpFilesize
216KB
-
memory/784-64-0x0000000002030000-0x0000000002078000-memory.dmpFilesize
288KB
-
memory/1988-61-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmpFilesize
8KB
-
memory/1988-62-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB