Overview
overview
8Static
static
8æ²³æºä¸‹è...om.url
windows7-x64
1æ²³æºä¸‹è...om.url
windows10-2004-x64
1简單挂å...nj.dll
windows7-x64
8简單挂å...nj.dll
windows10-2004-x64
8简單挂å...ro.dll
windows7-x64
8简單挂å...ro.dll
windows10-2004-x64
8简單挂å...ip.dll
windows7-x64
1简單挂å...ip.dll
windows10-2004-x64
3简單挂å....0.exe
windows7-x64
8简單挂å....0.exe
windows10-2004-x64
8简單挂å...04.url
windows7-x64
1简單挂å...04.url
windows10-2004-x64
1简單挂å...om.url
windows7-x64
1简單挂å...om.url
windows10-2004-x64
1简單挂å...”1.exe
windows7-x64
8简單挂å...”1.exe
windows10-2004-x64
8简單挂å...”.exe
windows7-x64
7简單挂å...”.exe
windows10-2004-x64
6Analysis
-
max time kernel
144s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 20:18
Behavioral task
behavioral1
Sample
æ²³æºä¸‹è½½ç«™-xz7.com.url
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
æ²³æºä¸‹è½½ç«™-xz7.com.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
简單挂å…曊版⒔1/SimpInj.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
简單挂å…曊版⒔1/SimpInj.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
简單挂å…曊版⒔1/SimplePro.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
简單挂å…曊版⒔1/SimplePro.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
简單挂å…曊版⒔1/zip.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
简單挂å…曊版⒔1/zip.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
简單挂å…曊版⒔1/ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
简單挂å…曊版⒔1/ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
简單挂å…曊版⒔1/在线咨询QQ:910001904.url
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
简單挂å…曊版⒔1/在线咨询QQ:910001904.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
简單挂å…曊版⒔1/简å•æŒ‚官网:s1904.com.url
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
简單挂å…曊版⒔1/简å•æŒ‚官网:s1904.com.url
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
简單挂å…曊版⒔1/简單挂å…曊版⒔1.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
简單挂å…曊版⒔1/简單挂å…曊版⒔1.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
简單挂å…曊版⒔1/霸王æ¶é”.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
简單挂å…曊版⒔1/霸王æ¶é”.exe
Resource
win10v2004-20220812-en
General
-
Target
简單挂å…曊版⒔1/ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe
-
Size
244KB
-
MD5
6f92c15bf863fa0e17a4e35bd4fd51fa
-
SHA1
6ca6a62a24bdaf0447fb9ae27f49253226cf9df8
-
SHA256
09342e5b817da7d66f0d72a30f05ac70a40fd513ecfedc4ddae629f08db13e9e
-
SHA512
fbb6db3add179bfe27d72fcefcfeeb05643e764be6c8064b7c99fd032ab6b2093a774550fb3ada2160fab2092b8e8b0766880a610548924383fc0a714a1faaba
-
SSDEEP
6144:fo6ZAZuWvOFBPbcLb4aVWKEyWLxkoXPVrFayCov9oTkN:g8WwA4ItJWlkOPVFSoVooN
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\yhplayers.sys ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe -
Processes:
resource yara_rule behavioral9/memory/1656-55-0x0000000000400000-0x000000000048B000-memory.dmp vmprotect behavioral9/memory/1656-56-0x0000000000400000-0x000000000048B000-memory.dmp vmprotect -
Drops file in System32 directory 4 IoCs
Processes:
ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exedescription ioc process File created C:\Windows\SysWOW64\5B21VIHdJ.sys ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe File opened for modification C:\Windows\SysWOW64\5B21VIHdJ.sys ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe File opened for modification C:\Windows\SysWOW64\5B21VIHdJ.systmp ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe File created C:\Windows\SysWOW64\440bd1rM.sys ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 460 460 460 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exepid process 1656 ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe 1656 ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\简單挂å…曊版⒔1\ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe"C:\Users\Admin\AppData\Local\Temp\简單挂å…曊版⒔1\ä¼ å¥‡é€šç”¨å˜é€Ÿå™¨7.0.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx