Overview
overview
9Static
static
jycms/捷�...pk.dll
windows7-x64
9jycms/捷�...pk.dll
windows10-2004-x64
9lpk.dll
windows7-x64
9lpk.dll
windows10-2004-x64
9sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...tor.js
windows7-x64
1sxw/admin/...tor.js
windows10-2004-x64
1sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...ut.htm
windows7-x64
1sxw/admin/...ut.htm
windows10-2004-x64
1sxw/admin/...or.htm
windows7-x64
1sxw/admin/...or.htm
windows10-2004-x64
1sxw/admin/...bg.vbs
windows7-x64
1sxw/admin/...bg.vbs
windows10-2004-x64
1sxw/admin/...ig.vbs
windows7-x64
1sxw/admin/...ig.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ta.vbs
windows7-x64
1sxw/admin/...ta.vbs
windows10-2004-x64
1sxw/admin/...dj.vbs
windows7-x64
1sxw/admin/...dj.vbs
windows10-2004-x64
1sxw/admin/...il.vbs
windows7-x64
1sxw/admin/...il.vbs
windows10-2004-x64
1sxw/admin/...rm.vbs
windows7-x64
1sxw/admin/...rm.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ly.vbs
windows7-x64
1sxw/admin/...ly.vbs
windows10-2004-x64
1Analysis
-
max time kernel
50s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
sxw/admin/Editor/Editor.asp
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
sxw/admin/Editor/Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
sxw/admin/Editor/Editor.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
sxw/admin/Editor/Editor.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
sxw/admin/Editor/include/about.htm
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
sxw/admin/Editor/include/about.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
sxw/admin/admin_bg.vbs
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
sxw/admin/admin_bg.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
sxw/admin/admin_config.vbs
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
sxw/admin/admin_config.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
sxw/admin/admin_config.xml.vbs
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
sxw/admin/admin_config.xml.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
sxw/admin/admin_data.vbs
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
sxw/admin/admin_data.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
sxw/admin/admin_dj.vbs
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
sxw/admin/admin_dj.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
sxw/admin/admin_email.vbs
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
sxw/admin/admin_email.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
sxw/admin/admin_form.vbs
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
sxw/admin/admin_form.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
sxw/admin/admin_html.vbs
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
sxw/admin/admin_html.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
sxw/admin/admin_ly.vbs
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
sxw/admin/admin_ly.vbs
Resource
win10v2004-20221111-en
General
-
Target
lpk.dll
-
Size
217KB
-
MD5
aa28054265b1c2fb7748fb21ab5984a7
-
SHA1
2fd0396a49a7024ce53783995c4b288e7c596342
-
SHA256
004785903afd37cace27aae4ed28b2130c2691798b82132debb42659d223b615
-
SHA512
aaa000f7947a92e834b3175facfcefd1d9f53e3204f1b26f10c19c4c1b5ea720b6d6fc45d88a909ca0dbe425c39a6885496f8673e4ff1ebff6a709a351322e28
-
SSDEEP
6144:u24mCyHAWyPgWITYJ0Ax9N17xM2lxq27Wo/GEvdt:u24xvPgWGYj9X7xM2Lq27D/GEvdt
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral3/files/0x0009000000013a13-62.dat acprotect behavioral3/files/0x0007000000014124-68.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 1224 hrlB7BC.tmp 1644 gaycwq.exe -
Loads dropped DLL 4 IoCs
pid Process 1704 rundll32.exe 1704 rundll32.exe 1224 hrlB7BC.tmp 1644 gaycwq.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\gaycwq.exe hrlB7BC.tmp File opened for modification C:\Windows\SysWOW64\gaycwq.exe hrlB7BC.tmp -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1644 set thread context of 960 1644 gaycwq.exe 30 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1224 hrlB7BC.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1224 hrlB7BC.tmp 1644 gaycwq.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1668 wrote to memory of 1704 1668 rundll32.exe 27 PID 1704 wrote to memory of 1224 1704 rundll32.exe 28 PID 1704 wrote to memory of 1224 1704 rundll32.exe 28 PID 1704 wrote to memory of 1224 1704 rundll32.exe 28 PID 1704 wrote to memory of 1224 1704 rundll32.exe 28 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1644 wrote to memory of 960 1644 gaycwq.exe 30 PID 1224 wrote to memory of 764 1224 hrlB7BC.tmp 31 PID 1224 wrote to memory of 764 1224 hrlB7BC.tmp 31 PID 1224 wrote to memory of 764 1224 hrlB7BC.tmp 31 PID 1224 wrote to memory of 764 1224 hrlB7BC.tmp 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\hrlB7BC.tmpC:\Users\Admin\AppData\Local\Temp\hrlB7BC.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrlB7BC.tmp > nul4⤵PID:764
-
-
-
-
C:\Windows\SysWOW64\gaycwq.exeC:\Windows\SysWOW64\gaycwq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:960
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9