Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe
-
Size
7.1MB
-
MD5
64475e899bb2e13cf5e5dc3682251f87
-
SHA1
baaf73bcd9c57b3ff5697b6cf5dc674f6076b2df
-
SHA256
c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61
-
SHA512
816f1da027ef5eab7bbefbcc2f8b059fa8752533bad4b3dcad86f74eb1f3a94dac41d867d8ae4cf44d2d7a316bcbef6a08df4bd12c287de5119a00a42fd51c36
-
SSDEEP
196608:ZxJfix83B5XBZRv99jYimOBKPL2QWFpMie28xFmlWYE:7JfiazZ1RmDPL2TjdflWYE
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\YouXunBox\Cache\images\pz-jiao.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\problem.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\progress.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\loading.gif c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\v_btn.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\big.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\share.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\download\download_engine.dll c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\back_pl.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\startgame.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\tag.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\shoujizhushou.exe c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\share.html c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\dl_menu_gray.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\fs_ts_bg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\no_img.jpg c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\tb-ati.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\allgame.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\downtab.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\EditBorder.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\logo.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\myright.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\adbg_close.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Config.ini c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\fsbox_loading.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\fs_btn.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\usb_bg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\js\box2.js c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\mydelete.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\seting.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\sj_listbg_end.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\starbg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\loading_con.html c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\mypostion.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\start.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\tray_menu.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\tray_menu_hover.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\download\dl_peer_id.dll c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\loading_text.gif c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\tb-win7.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\download\atl71.dll c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\download\XLCrypto.dll c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\list_newbg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\newtag.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\shadow.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\apk\AdbWinUsbApi.dll c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\pl2.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\tb-vista.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\yxsjb_aerror.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\我的游戏.lnk c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\morepx_bg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\start.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\win-64.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\fs_succes.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\apk\aapt.exe c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\dstar.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\loading_t.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\images\bottompz-bg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\game_bg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\Common\megtip.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\imagezz.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\box_five\images\list_tjbg.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\Cache\css\gamestart_con.css c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe File created C:\Program Files (x86)\YouXunBox\skins\assistant\cs_install.png c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe"C:\Users\Admin\AppData\Local\Temp\c30dd78fd823ad6258b9df95f909ef368f67f0e3c9e34e9a09d25034d6d05d61.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD508d15bbcc711a2c9b4a49f7c022d3299
SHA1f53bb62304d61796e65c1ce5e0e5d2c69a2bf79d
SHA2568a033bde928a3c069f0c0360e3f45a2c41cdea9e6b55f3e54c973063069f71d8
SHA51201d64eb02d3785f00ebe9316d834cffdeb70cfcf91c2c7b24dc52dbb288e866ae12942c855161b2974634691c0d078bfb512a7539c111e071fe52b24d42cdb6b
-
Filesize
1.3MB
MD508d15bbcc711a2c9b4a49f7c022d3299
SHA1f53bb62304d61796e65c1ce5e0e5d2c69a2bf79d
SHA2568a033bde928a3c069f0c0360e3f45a2c41cdea9e6b55f3e54c973063069f71d8
SHA51201d64eb02d3785f00ebe9316d834cffdeb70cfcf91c2c7b24dc52dbb288e866ae12942c855161b2974634691c0d078bfb512a7539c111e071fe52b24d42cdb6b
-
Filesize
1.3MB
MD508d15bbcc711a2c9b4a49f7c022d3299
SHA1f53bb62304d61796e65c1ce5e0e5d2c69a2bf79d
SHA2568a033bde928a3c069f0c0360e3f45a2c41cdea9e6b55f3e54c973063069f71d8
SHA51201d64eb02d3785f00ebe9316d834cffdeb70cfcf91c2c7b24dc52dbb288e866ae12942c855161b2974634691c0d078bfb512a7539c111e071fe52b24d42cdb6b
-
Filesize
414KB
MD51f2c7f7e68b251c2c95c028117e46c76
SHA156fffda64ab8b3305566d011369590774d5f996e
SHA2566cd5695877242bac7e7c1bcc98cdf109f2e7ca253411bbc1e53cf187479c188a
SHA512a6d4fd5607b6ee7706fb845efcd12cc89a7691b3ee9a27b3166ec71c6072f31483f88b736f8d13b40fc6fce3ea5868d776748bcf76b8b94d3402f94196dff173