6afbd251b227c166e1b6c02e002fa8e23084a46367270a25b9460896da28eba7

General

Target

大飞破解版/大飞视距.exe
Size

3.8MB
MD5

57c10b764a04c7becd89b8159f5fa88a
SHA1

84cfd16944399f66550ab8f7e958146903e455ef
SHA256

4536efcc9382cd4498470c36f16267882d4173e58dfa4cfee880e198e7d8d8c6
SHA512

abee86b8b4d83bbbaa953caba2f8bd556ba4c41748079623cd4933c9662589d62244b80872234c04b4e6745b4bb77a0e9638fbc001eeaee0341050ed82ff1915
SSDEEP

98304:eBVZB/g2p6FYskEhipqdwkLQHHhsSYt8d7+94qoa+N0:Q36+skCfsKSOo+93H

Score

8^/10

evasion upx vmprotect

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

大飞视距.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "0"	大飞视距.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1"	大飞视距.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral5/memory/1240-65-0x0000000000860000-0x000000000089D000-memory.dmp	upx
behavioral5/memory/1240-68-0x0000000000860000-0x000000000089D000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral5/memory/1240-57-0x0000000002880000-0x0000000002A4D000-memory.dmp	vmprotect
behavioral5/memory/1240-59-0x0000000002880000-0x0000000002A4D000-memory.dmp	vmprotect

Loads dropped DLL 1 IoCs

Processes:

大飞视距.exe

pid process

1240 大飞视距.exe

pid	process
1240	大飞视距.exe

Drops file in System32 directory 2 IoCs

Processes:

大飞视距.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svchost.exe	大飞视距.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe	大飞视距.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

大飞视距.exe

pid process

1240 大飞视距.exe

pid	process
1240	大飞视距.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

大飞视距.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	大飞视距.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?28879"	大飞视距.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/kfi1997"	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/kfi1997"	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?kfi1997"	大飞视距.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

Processes:

大飞视距.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	大飞视距.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/kfi1997"	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.2345.com/kfi1997"	大飞视距.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kfi1997"	大飞视距.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

大飞视距.exe

description	ioc	process
Key created	\REGISTRY\USER\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	大飞视距.exe
Key created	\REGISTRY\USER\SOFTWARE	大飞视距.exe
Key created	\REGISTRY\USER\Software\Policies\Microsoft\Internet Explorer\Main	大飞视距.exe
Key created	\REGISTRY\USER\Software\Microsoft\Internet Explorer\Main	大飞视距.exe
Key created	\REGISTRY\USER\Software	大飞视距.exe

Modifies registry class 32 IoCs

Processes:

大飞视距.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command = "C:\\Program Files\\Internet Explorer\\iexplore.exe %1 http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\Search Bar = "http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\"http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	大飞视距.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Policies\Microsoft\Internet Explorer\Main	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies\Microsoft\Internet Explorer\Main	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies\Microsoft	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/kfi1997"	大飞视距.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S-1-5-21-1202660629-2147037411-854245398-500\CLSID	大飞视距.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node	大飞视距.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID	大飞视距.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command = "C:\\Program Files\\Internet Explorer\\iexplore.exe %1 http://www.2345.com/kfi1997"	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Policies\Microsoft\Internet Explorer	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	大飞视距.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	大飞视距.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main	大飞视距.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

大飞视距.exe

pid process

1240 大飞视距.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

大飞视距.exe

pid process

1240 大飞视距.exe
1240 大飞视距.exe
1240 大飞视距.exe

pid	process
1240	大飞视距.exe

pid	process
1240	大飞视距.exe
1240	大飞视距.exe
1240	大飞视距.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

大飞视距.exe

description	pid	process	target process
PID 1240 wrote to memory of 1936	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 1936	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 1936	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 1936	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 760	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 760	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 760	1240	大飞视距.exe	svchost.exe
PID 1240 wrote to memory of 760	1240	大飞视距.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\大飞破解版\大飞视距.exe
"C:\Users\Admin\AppData\Local\Temp\大飞破解版\大飞视距.exe"
1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:1936
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lazycommon.dll

Filesize
676KB

MD5
033d1db88147b6dab9a1795027a87e74

SHA1
f6e9f5e82af3e9546711d42aab705a494e851d44

SHA256
a85b830cec14449763cc174d600324372798f2bb8c5276546419cc6b2563db1c

SHA512
7689fc5812fc89e27f5691259c15e4109b3ecfd1933393e1d9ce2d63acc37149aa4cf6124c353b62b39352162e9509d7b49caeaabc1618c8e495a14cef095e33

Download Submit
memory/760-69-0x0000000000000000-mapping.dmp

Download
memory/1240-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1240-56-0x0000000010000000-0x00000000100AA000-memory.dmp

Filesize
680KB

Download
memory/1240-57-0x0000000002880000-0x0000000002A4D000-memory.dmp

Filesize
1.8MB

Download
memory/1240-59-0x0000000002880000-0x0000000002A4D000-memory.dmp

Filesize
1.8MB

Download
memory/1240-63-0x0000000010000000-0x00000000100AA000-memory.dmp

Filesize
680KB

Download
memory/1240-64-0x0000000002880000-0x0000000002A4D000-memory.dmp

Filesize
1.8MB

Download
memory/1240-65-0x0000000000860000-0x000000000089D000-memory.dmp

Filesize
244KB

Download
memory/1240-67-0x0000000002880000-0x0000000002A4D000-memory.dmp

Filesize
1.8MB

Download
memory/1240-68-0x0000000000860000-0x000000000089D000-memory.dmp

Filesize
244KB

Download
memory/1936-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads