967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188

General

Target

967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Size

484KB
MD5

1f3eee55252f1afb35769d8bf794a6fa
SHA1

bd83ef9565b306cd3d21bee0142e37282e0d01aa
SHA256

967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188
SHA512

f4025e5861012829c057259dbcc4d8948168b130a0c811f10d85b649c0f2717e65d3f9d9a0b892a0d46a6564e961c50971f0a992efdc4ec3df43736c698a09d5
SSDEEP

6144:BmoPUNKmeyE2vYz3pHAOiahl+woMQ+sujfgr8S:nPUNzevDpHhhlJBsubgr8

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ByrdPrtc.sys	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
File created	C:\Windows\SysWOW64\drivers\TimeProDrv.sys	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
File created	C:\Windows\SysWOW64\drivers\FwSpeedDrv.sys	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dummy.exe	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillAppTimeout = "20000"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\HungAppTimeout = "1000"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\First Home Page = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.baidu.com/index.php?tn=bdkaling_pg"	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
1932	967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe

C:\Users\Admin\AppData\Local\Temp\967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe
"C:\Users\Admin\AppData\Local\Temp\967ac8d6cd653953e1efb1096ae00d8049978218234d1011c8538b87e0c35188.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1932-56-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads