7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482

General

Target

7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe
Size

11.8MB
MD5

d2ab6631f3c4161a8be7ae71335a48bb
SHA1

22f0515532bc307660adeaeedc3eea54e8929d24
SHA256

7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482
SHA512

fcb95889e27fb2417a7246ccbf15b0b399c34d63acf25d793deff9c7469874a5b0c839bb9db2541822e44a1ac511c412de2140215c0c887cba32ee174cdfd940
SSDEEP

196608:92zbRhlKeLXsJeQcKSLjBREjdRQKms54Bgsy35xzy1fbdpHV8Zmkuv8gBd6bdIqS:eRSeAJeQcdLjI5RCsc835xzylfHmZmkm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
1568	授权-20221118.exe

Loads dropped DLL 3 IoCs

pid	Process
1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\我的程序\is-1DMKP.tmp	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
File created	C:\Program Files (x86)\我的程序\is-TLD7I.tmp	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
File opened for modification	C:\Program Files (x86)\我的程序\unins000.dat	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
File opened for modification	C:\Program Files (x86)\我的程序\授权-20221118.exe	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
File created	C:\Program Files (x86)\我的程序\unins000.dat	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
File created	C:\Program Files (x86)\我的程序\is-1DMKP.tmp	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
1568	授权-20221118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	授权-20221118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1324 wrote to memory of 1876	1324	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe	28
PID 1876 wrote to memory of 1568	1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp	29
PID 1876 wrote to memory of 1568	1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp	29
PID 1876 wrote to memory of 1568	1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp	29
PID 1876 wrote to memory of 1568	1876	7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp	29

C:\Users\Admin\AppData\Local\Temp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe
"C:\Users\Admin\AppData\Local\Temp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\is-9QKU5.tmp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9QKU5.tmp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp" /SL5="$7014E,11648358,718848,C:\Users\Admin\AppData\Local\Temp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Program Files (x86)\我的程序\授权-20221118.exe
    "C:\Program Files (x86)\我的程序\授权-20221118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\我的程序\授权-20221118.exe

Filesize
16.4MB

MD5
99057a7b457ce8be7dd4b1251d8b634e

SHA1
7e8e00b277089fc23b7517c8576b61e428921801

SHA256
895834ac4ba3e6c9902cacbf245ccc179630edcf731a62b8947791b30827cda6

SHA512
9663e9912d4e344b0ca94894931f1b94a63d6728411d4212c7a58ac38a8b1bbee8ece0f7a18bb12ef87d2621145f288c30fbd97be9cfcd64e132207083b61d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QKU5.tmp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Filesize
2.4MB

MD5
afcb0ce52f3275932bbe693168cbec61

SHA1
aaaaa41948d3984112f6e488c3be447069dc516d

SHA256
09e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68

SHA512
a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QKU5.tmp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Filesize
2.4MB

MD5
afcb0ce52f3275932bbe693168cbec61

SHA1
aaaaa41948d3984112f6e488c3be447069dc516d

SHA256
09e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68

SHA512
a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416

Download Submit
\Program Files (x86)\我的程序\授权-20221118.exe

Filesize
16.4MB

MD5
99057a7b457ce8be7dd4b1251d8b634e

SHA1
7e8e00b277089fc23b7517c8576b61e428921801

SHA256
895834ac4ba3e6c9902cacbf245ccc179630edcf731a62b8947791b30827cda6

SHA512
9663e9912d4e344b0ca94894931f1b94a63d6728411d4212c7a58ac38a8b1bbee8ece0f7a18bb12ef87d2621145f288c30fbd97be9cfcd64e132207083b61d42

Download Submit
\Program Files (x86)\我的程序\授权-20221118.exe

Filesize
16.4MB

MD5
99057a7b457ce8be7dd4b1251d8b634e

SHA1
7e8e00b277089fc23b7517c8576b61e428921801

SHA256
895834ac4ba3e6c9902cacbf245ccc179630edcf731a62b8947791b30827cda6

SHA512
9663e9912d4e344b0ca94894931f1b94a63d6728411d4212c7a58ac38a8b1bbee8ece0f7a18bb12ef87d2621145f288c30fbd97be9cfcd64e132207083b61d42

Download Submit
\Users\Admin\AppData\Local\Temp\is-9QKU5.tmp\7d633a27a45128e9fbaaf56a8c16f190aa95b53f3cca7d77e5b7341bf6c9b482.tmp

Filesize
2.4MB

MD5
afcb0ce52f3275932bbe693168cbec61

SHA1
aaaaa41948d3984112f6e488c3be447069dc516d

SHA256
09e32653389d6b965db754a9edd5f45e782fdb4f19e25a23209e5aac71598e68

SHA512
a10416d6825f8a5db60cccc04cfa3de08f64e309d25078a4ec3c42a626d6b1575666cf965f1cc40a645f332d00bbafff522dcbea1851d09aea444f6ca60d0416

Download Submit
memory/1324-63-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1324-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1324-55-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1324-69-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1568-70-0x0000000002EC0000-0x0000000002F4B000-memory.dmp

Filesize
556KB

Download
memory/1876-61-0x0000000074421000-0x0000000074423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing