35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

Analysis

max time kernel
84s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2023, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
薪资补贴填写模板.exe
Size 3.8MB
Sample230417-azma5sec3w
SHA256 35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5
MD5 13edc9e053cfe10575e779d4e048af5b
SHA1 e950cc66152aa2539f6d57a506abc40263f34297
SHA512 20f9b6529a9b11f682249cfcc2c5fd666a88723939ff5746df54b2af71d8c31c54341885c53b02027d39d413f98b25d3dc565c077c8b8fe7fba84115e2577062
SSDEEP 98304:PJydxM02SoemiJC45AGqybV8k4mh4YNrg8xubmKyHx:Ude02SZRC4G6Z8k4OTNbxumKa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	薪资补贴填写模板.exe

Executes dropped EXE 2 IoCs

pid	Process
1416	WinRAR1.exe
3836	HQf_VP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	3836	WerFault.exe	84

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	WinRAR1.exe
1416	WinRAR1.exe
1416	WinRAR1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1416	4464	薪资补贴填写模板.exe	82
PID 4464 wrote to memory of 1416	4464	薪资补贴填写模板.exe	82
PID 4464 wrote to memory of 3836	4464	薪资补贴填写模板.exe	84
PID 4464 wrote to memory of 3836	4464	薪资补贴填写模板.exe	84

C:\Users\Admin\AppData\Local\Temp\薪资补贴填写模板.exe
"C:\Users\Admin\AppData\Local\Temp\薪资补贴填写模板.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\Temp\WinRAR1.exe
  "C:\Windows\Temp\WinRAR1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1416
- C:\Windows\Temp\HQf_VP.exe
  "C:\Windows\Temp\HQf_VP.exe"
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3836 -s 1088
    3⤵
    - Program crash
    PID:1304

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3836 -ip 3836
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HQf_VP.exe

Path C:\Windows\Temp\HQf_VP.exe
Size 50.4MB
SHA256 57d16edafb10afad45a804b7743566fdfe4b914d29ffc7aeae82782a36d8097c
MD5 a0ca4e161f5f539e1ae85a86fa51ebb0
SHA1 1e6d3fe0a90ab508de4b76b8c714b22cc4e4e9d5
SHA512 b3b240c82389398c48f70faa28f124eaf78c62e438903c90b752f773542d63a9fe679e3d5083bb74c299f7d0c20eeff0664c8e22036db2d40d4aa25ef26184c9
SSDEEP 12288:xZr1JTJmktd7wk3Ta77Hp0fWAUmBnkcvYFezuor:x9JmktucvYFezuor
MD5 SHA1 SHA512 SSDEEP

Submit Download

HQf_VP.exe

Path C:\Windows\Temp\HQf_VP.exe
Size 50.4MB
SHA256 57d16edafb10afad45a804b7743566fdfe4b914d29ffc7aeae82782a36d8097c
MD5 a0ca4e161f5f539e1ae85a86fa51ebb0
SHA1 1e6d3fe0a90ab508de4b76b8c714b22cc4e4e9d5
SHA512 b3b240c82389398c48f70faa28f124eaf78c62e438903c90b752f773542d63a9fe679e3d5083bb74c299f7d0c20eeff0664c8e22036db2d40d4aa25ef26184c9
SSDEEP 12288:xZr1JTJmktd7wk3Ta77Hp0fWAUmBnkcvYFezuor:x9JmktucvYFezuor
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinRAR1.exe

Path C:\Windows\Temp\WinRAR1.exe
Size 3.5MB
SHA256 37df462749e09ed68dc3de1aff04f6ea2a0519230c07f70f250a37665dd4a5e1
MD5 d33d39f171b46802c72c6afd89903ced
SHA1 72e08a1bf8d8579e7f50bd1d4226b73a69f0e6e6
SHA512 68216df4a2d0d742cf061331733ca0e0d376c47038c08d059837403d6a146838ce0520f8bbcfba19094906ae8a1dedf654c6687977f5e43edb6710d4ba0d875b
SSDEEP 98304:AO9OBfK30dHkYjrVu2TZ3sqfI4B0jIVtCdajPRTMRCVS/dcPVK:AOzkdj82N3I4m0VtCdjRCo/dctK
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinRAR1.exe

Path C:\Windows\Temp\WinRAR1.exe
Size 3.5MB
SHA256 37df462749e09ed68dc3de1aff04f6ea2a0519230c07f70f250a37665dd4a5e1
MD5 d33d39f171b46802c72c6afd89903ced
SHA1 72e08a1bf8d8579e7f50bd1d4226b73a69f0e6e6
SHA512 68216df4a2d0d742cf061331733ca0e0d376c47038c08d059837403d6a146838ce0520f8bbcfba19094906ae8a1dedf654c6687977f5e43edb6710d4ba0d875b
SSDEEP 98304:AO9OBfK30dHkYjrVu2TZ3sqfI4B0jIVtCdajPRTMRCVS/dcPVK:AOzkdj82N3I4m0VtCdjRCo/dctK
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinRAR1.exe

Path C:\Windows\Temp\WinRAR1.exe
Size 3.5MB
SHA256 37df462749e09ed68dc3de1aff04f6ea2a0519230c07f70f250a37665dd4a5e1
MD5 d33d39f171b46802c72c6afd89903ced
SHA1 72e08a1bf8d8579e7f50bd1d4226b73a69f0e6e6
SHA512 68216df4a2d0d742cf061331733ca0e0d376c47038c08d059837403d6a146838ce0520f8bbcfba19094906ae8a1dedf654c6687977f5e43edb6710d4ba0d875b
SSDEEP 98304:AO9OBfK30dHkYjrVu2TZ3sqfI4B0jIVtCdajPRTMRCVS/dcPVK:AOzkdj82N3I4m0VtCdjRCo/dctK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3836-157-0x000002B36B030000-0x000002B36B040000-memory.dmp

Download

memory/3836-158-0x00007FF729E10000-0x00007FF729E7C000-memory.dmp

Download

memory/3836-159-0x000002B36B030000-0x000002B36B040000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads