989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1

General

Target

989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
Size

128KB
MD5

af1aa28e81f766e24b83af5d82ec5033
SHA1

abe88fe1089bc3ee2e11dc91e652da8a515bdc9f
SHA256

989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1
SHA512

7cd72021b3d14c2ff94852816ae071ea22291ce8f22b9ccbdce2afad2bb2119624769e6393417598a2cc2da1d5a5e9d58697e7418af5b06aa6c316d3f1c370b3
SSDEEP

1536:tmbWY4i1ahaQUGFbo2c+VGnRZehJ4dDTmbM+jW5gUKChv9Tvv/ZGCK0ma9ncKHvj:tpBAaaW9MnLii1F+zlsn3J1OTbcl

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\f:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\i:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\m:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\n:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\o:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\p:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\t:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\z:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\a:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\j:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\k:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\s:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\h:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\u:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\w:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\b:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\g:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\l:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\q:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\r:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\v:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\x:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File opened (read-only)	\??\y:	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\TongJiBiaoJi.ini	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
File created	C:\Windows\DangerBiaoJi.ini	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
1788	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1788	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
1788	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
1788	989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe

C:\Users\Admin\AppData\Local\Temp\989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe
"C:\Users\Admin\AppData\Local\Temp\989ca520d54885c81812d500126f9ac13c4ba71b00710655f16b0d97fb39d5b1.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1788