6ae296e1d6faefa0851a7f40736d4404409eb1fa3e2b884664a1cc6f1107bb47

Analysis

max time kernel
73s
max time network
72s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

票-据202331554102115001.exe
Size

3.3MB
MD5

50298c571eeb5d3c9dbb5945f5692d2d
SHA1

82817defaabee93a9d15c78e763137c4c2d1dcb4
SHA256

6ae296e1d6faefa0851a7f40736d4404409eb1fa3e2b884664a1cc6f1107bb47
SHA512

8a953c3c14c30532cfad0f5c83cd3f267d0625dc333d3510647e3ab82c0ad7c27fe1548ea75975be8f28e64a1c3104c7729858a31fbed9c24957a15d56a44f3b
SSDEEP

49152:53wqqmcOSW0FONVReXFYYjSpHl9r9zzoMr6YNDsxmDb7S1xR+VXHxasznBKWKv:53wqZDjcL8rf6YNoxmDbm1xR

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

music.exe_config.exe_config.exe

pid process

1360 music.exe
1160 _config.exe
1616 _config.exe
Loads dropped DLL 3 IoCs

Processes:

票-据202331554102115001.exe

pid process

1116 票-据202331554102115001.exe
1116 票-据202331554102115001.exe
1116 票-据202331554102115001.exe

pid	process
1116	票-据202331554102115001.exe
1116	票-据202331554102115001.exe
1116	票-据202331554102115001.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

music.exe

description	ioc	process
File opened (read-only)	\??\G:	music.exe
File opened (read-only)	\??\M:	music.exe
File opened (read-only)	\??\Q:	music.exe
File opened (read-only)	\??\T:	music.exe
File opened (read-only)	\??\Y:	music.exe
File opened (read-only)	\??\H:	music.exe
File opened (read-only)	\??\I:	music.exe
File opened (read-only)	\??\L:	music.exe
File opened (read-only)	\??\X:	music.exe
File opened (read-only)	\??\V:	music.exe
File opened (read-only)	\??\Z:	music.exe
File opened (read-only)	\??\B:	music.exe
File opened (read-only)	\??\J:	music.exe
File opened (read-only)	\??\O:	music.exe
File opened (read-only)	\??\P:	music.exe
File opened (read-only)	\??\S:	music.exe
File opened (read-only)	\??\U:	music.exe
File opened (read-only)	\??\W:	music.exe
File opened (read-only)	\??\E:	music.exe
File opened (read-only)	\??\F:	music.exe
File opened (read-only)	\??\K:	music.exe
File opened (read-only)	\??\N:	music.exe
File opened (read-only)	\??\R:	music.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

music.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	music.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	music.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

music.exe

pid	process
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe
1360	music.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

music.exe

pid process

1360 music.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

music.exehelppane.exe

description pid process

Token: 33 1360 music.exe
Token: SeIncBasePriorityPrivilege 1360 music.exe
Token: SeTakeOwnershipPrivilege 1032 helppane.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

helppane.exe

pid process

1032 helppane.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

music.exehelppane.exe

pid process

1360 music.exe
1032 helppane.exe
1032 helppane.exe

description	pid	process
Token: 33	1360	music.exe
Token: SeIncBasePriorityPrivilege	1360	music.exe
Token: SeTakeOwnershipPrivilege	1032	helppane.exe

pid	process
1032	helppane.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

票-据202331554102115001.exehelppane.exe_config.exe

description	pid	process	target process
PID 1116 wrote to memory of 1360	1116	票-据202331554102115001.exe	music.exe
PID 1116 wrote to memory of 1360	1116	票-据202331554102115001.exe	music.exe
PID 1116 wrote to memory of 1360	1116	票-据202331554102115001.exe	music.exe
PID 1116 wrote to memory of 1360	1116	票-据202331554102115001.exe	music.exe
PID 1116 wrote to memory of 1160	1116	票-据202331554102115001.exe	_config.exe
PID 1116 wrote to memory of 1160	1116	票-据202331554102115001.exe	_config.exe
PID 1116 wrote to memory of 1160	1116	票-据202331554102115001.exe	_config.exe
PID 1116 wrote to memory of 1160	1116	票-据202331554102115001.exe	_config.exe
PID 1032 wrote to memory of 1616	1032	helppane.exe	_config.exe
PID 1032 wrote to memory of 1616	1032	helppane.exe	_config.exe
PID 1032 wrote to memory of 1616	1032	helppane.exe	_config.exe
PID 1032 wrote to memory of 1616	1032	helppane.exe	_config.exe
PID 1616 wrote to memory of 1904	1616	_config.exe	reg.exe
PID 1616 wrote to memory of 1904	1616	_config.exe	reg.exe
PID 1616 wrote to memory of 1904	1616	_config.exe	reg.exe
PID 1616 wrote to memory of 1904	1616	_config.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\票-据202331554102115001.exe
"C:\Users\Admin\AppData\Local\Temp\票-据202331554102115001.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Roaming\EHHJJLLLNP\music.exe
"C:\Users\Admin\AppData\Roaming\EHHJJLLLNP\music.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Users\Admin\AppData\Local\Temp\_config.exe
"C:\Users\Admin\AppData\Local\Temp\_config.exe"
2⤵
- Executes dropped EXE
PID:1160

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\_config.exe
"C:\Users\Admin\AppData\Local\Temp\_config.exe" shell32.dll,ShellExec_RunDLL reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\EHHJJLLLNP" /f
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\EHHJJLLLNP" /f
3⤵
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.lnk
Filesize
2KB

MD5
db271f32bf8072ec46a5b098595ace3c

SHA1
6c7f4ece8982221d50d5a77f12e8833805fa31a3

SHA256
26bc23134a6a9a5e0ba61a7d9540fe4ff5de262f600cb634ab70f317eb8667f4

SHA512
c96f4a8a262cdf474355ceea42ec2716e4d493d3f802b6596a0653ab4941a664861d7b259e3b6f0223afdd8191d8ac5d052c00a29a62df6b7b9ea92f8d6d4b26

Download Submit
C:\Users\Admin\AppData\Roaming\EHHJJLLLNP\music.exe
Filesize
108KB

MD5
a6a9abf50eb980d12622e14c237a9f37

SHA1
8ef76ad1aaac59cc082a94dd1fa65338c7d59111

SHA256
1ef14f23c1c3fad652b81376340e8882a942b27052f85e96040067fc0ac4cd5a

SHA512
952a4e01f4d6018289db4ead6b52d50f9dfa2939ebe37294c2c07c4af18c20d9beb3f65b41a04cfc92f26b61794b53bd8884a78cbe4be6cf4904a9b608fd1252

Download Submit
C:\Users\Admin\AppData\Roaming\EHHJJLLLNP\music.exe
Filesize
108KB

MD5
a6a9abf50eb980d12622e14c237a9f37

SHA1
8ef76ad1aaac59cc082a94dd1fa65338c7d59111

SHA256
1ef14f23c1c3fad652b81376340e8882a942b27052f85e96040067fc0ac4cd5a

SHA512
952a4e01f4d6018289db4ead6b52d50f9dfa2939ebe37294c2c07c4af18c20d9beb3f65b41a04cfc92f26b61794b53bd8884a78cbe4be6cf4904a9b608fd1252

Download Submit
\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
\Users\Admin\AppData\Roaming\EHHJJLLLNP\music.exe
Filesize
108KB

MD5
a6a9abf50eb980d12622e14c237a9f37

SHA1
8ef76ad1aaac59cc082a94dd1fa65338c7d59111

SHA256
1ef14f23c1c3fad652b81376340e8882a942b27052f85e96040067fc0ac4cd5a

SHA512
952a4e01f4d6018289db4ead6b52d50f9dfa2939ebe37294c2c07c4af18c20d9beb3f65b41a04cfc92f26b61794b53bd8884a78cbe4be6cf4904a9b608fd1252

Download Submit
memory/1032-93-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1116-56-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1116-59-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-95-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1116-94-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-66-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-63-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1116-67-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1116-62-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-61-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-60-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1116-64-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1116-58-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download
memory/1360-78-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1360-77-0x0000000000F10000-0x0000000000F5C000-memory.dmp

Filesize
304KB

Download
memory/1360-74-0x0000000000F10000-0x0000000000F5C000-memory.dmp

Filesize
304KB

Download
memory/1360-96-0x0000000000F10000-0x0000000000F5C000-memory.dmp

Filesize
304KB

Download