Overview

overview

8

Static

static

8

1001下载乐园.url

windows7-x64

1

1001下载乐园.url

windows10-2004-x64

1

EChartBar.dll

windows7-x64

1

EChartBar.dll

windows10-2004-x64

1

TrayIcon.dll

windows7-x64

1

TrayIcon.dll

windows10-2004-x64

3

eAPI.dll

windows7-x64

1

eAPI.dll

windows10-2004-x64

1

krnln.dll

windows7-x64

1

krnln.dll

windows10-2004-x64

1

main.exe

windows7-x64

1

main.exe

windows10-2004-x64

1

xplib.dll

windows7-x64

1

xplib.dll

windows10-2004-x64

1

yhzj.exe

windows7-x64

8

yhzj.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    176s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 22:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yhzj.exe

  • Size

    50KB

  • MD5

    88b39d09645aa838387fc95670aa36c6

  • SHA1

    e16f50586abf4e6857c8537b23ddd0a45a9a25a2

  • SHA256

    53d880178a910f1ed651139ce5c869dd215e2f309718a7295612131b608bcab6

  • SHA512

    6c74f37c961782ceb6da599fd8ee64432c9f8cfa19db17827bf0955224b3d2c2dc9ffc7188984915e57d436d083e2acdc28e8c06e97941c127766a3bd1174f63

  • SSDEEP

    768:Ka1aKW+gwxMvEGiCuBEPKTBZGgV6zBIx7QEHzEaUxCCKsPa4TaDIv8dP:Khxo4E3196zMpHwACKG+I8P

Score
8/10
persistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\yhzj.exe
    "C:\Users\Admin\AppData\Local\Temp\yhzj.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2288
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3776
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1724
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1508-253-0x000001EB2D7FF000-0x000001EB2D803000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1508-258-0x000001EB2D808000-0x000001EB2D80B000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1508-156-0x000001EB2A8F0000-0x000001EB2A910000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1508-260-0x000001EB2D808000-0x000001EB2D80B000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1508-165-0x000001EB2D790000-0x000001EB2D7B0000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1508-147-0x000001EB297D8000-0x000001EB297E0000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1508-150-0x000001EB2D6B0000-0x000001EB2D6D0000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1508-259-0x000001EB2D808000-0x000001EB2D80B000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1508-261-0x000001EB2D808000-0x000001EB2D80B000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1508-254-0x000001EB2D7FF000-0x000001EB2D803000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1508-153-0x000001EB3D7F0000-0x000001EB3D8F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/1508-251-0x000001EB2D7FF000-0x000001EB2D803000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1508-250-0x000001EB2D7FF000-0x000001EB2D803000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1508-252-0x000001EB2D7FF000-0x000001EB2D803000-memory.dmp
    Filesize

    16KB

    Download
  • memory/2288-134-0x0000000000400000-0x000000000042A499-memory.dmp
    Filesize

    169KB

    Download
  • memory/2288-132-0x0000000000400000-0x000000000042A499-memory.dmp
    Filesize

    169KB

    Download
  • memory/2288-240-0x0000000002550000-0x0000000002586000-memory.dmp
    Filesize

    216KB

    Download
  • memory/2288-137-0x0000000002590000-0x00000000025D8000-memory.dmp
    Filesize

    288KB

    Download
  • memory/2288-136-0x00000000022B0000-0x00000000022BC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/2288-135-0x0000000002550000-0x0000000002586000-memory.dmp
    Filesize

    216KB

    Download