Overview
overview
9Static
static
7YI_IoT_base.apk
android-9-x86
9ShareSDK.xml
windows7-x64
1ShareSDK.xml
windows10-2004-x64
1alibaba_pu...ld.otf
windows7-x64
3alibaba_pu...ld.otf
windows10-2004-x64
7alibaba_sa...ic.otf
windows7-x64
3alibaba_sa...ic.otf
windows10-2004-x64
7app.4df63c...87.css
windows7-x64
3app.4df63c...87.css
windows10-2004-x64
7bg-alarm-o...02.png
windows7-x64
3bg-alarm-o...02.png
windows10-2004-x64
3bg-alarm.d56d033.png
windows7-x64
3bg-alarm.d56d033.png
windows10-2004-x64
3bg-bind-su...17.png
windows7-x64
3bg-bind-su...17.png
windows10-2004-x64
3bg_w10_bin...83.png
windows7-x64
3bg_w10_bin...83.png
windows10-2004-x64
3bg_w10_bin...33.png
windows7-x64
3bg_w10_bin...33.png
windows10-2004-x64
3bg_w10_bin...9b.png
windows7-x64
3bg_w10_bin...9b.png
windows10-2004-x64
3bind-devic...60.png
windows7-x64
3bind-devic...60.png
windows10-2004-x64
3bind-devic...75.png
windows7-x64
3bind-devic...75.png
windows10-2004-x64
3bind-devic...97.png
windows7-x64
3bind-devic...97.png
windows10-2004-x64
3bind-fail.ee24f95.png
windows7-x64
3bind-fail.ee24f95.png
windows10-2004-x64
3bind-gate-...29.png
windows7-x64
3bind-gate-...29.png
windows10-2004-x64
3bind-gate-...b6.png
windows7-x64
3Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2023 08:35
Static task
static1
Behavioral task
behavioral1
Sample
YI_IoT_base.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
ShareSDK.xml
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
ShareSDK.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
alibaba_puhuiyi_bold.otf
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
alibaba_puhuiyi_bold.otf
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
alibaba_sans_medium_italic.otf
Resource
win7-20230703-en
Behavioral task
behavioral7
Sample
alibaba_sans_medium_italic.otf
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
app.4df63c69c64f6ef78419a0a528801587.css
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
app.4df63c69c64f6ef78419a0a528801587.css
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
bg-alarm-other.932c602.png
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
bg-alarm-other.932c602.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
bg-alarm.d56d033.png
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
bg-alarm.d56d033.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
bg-bind-success.e7c5c17.png
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
bg-bind-success.e7c5c17.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
bg_w10_bind_one.41d7983.png
Resource
win7-20230703-en
Behavioral task
behavioral17
Sample
bg_w10_bind_one.41d7983.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
bg_w10_bind_three.35c6433.png
Resource
win7-20230703-en
Behavioral task
behavioral19
Sample
bg_w10_bind_three.35c6433.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
bg_w10_bind_two.62f969b.png
Resource
win7-20230703-en
Behavioral task
behavioral21
Sample
bg_w10_bind_two.62f969b.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
bind-device-W10.7a5b360.png
Resource
win7-20230703-en
Behavioral task
behavioral23
Sample
bind-device-W10.7a5b360.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
bind-device-gate.46bb475.png
Resource
win7-20230703-en
Behavioral task
behavioral25
Sample
bind-device-gate.46bb475.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
bind-device-sensor.694c397.png
Resource
win7-20230703-en
Behavioral task
behavioral27
Sample
bind-device-sensor.694c397.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
bind-fail.ee24f95.png
Resource
win7-20230705-en
Behavioral task
behavioral29
Sample
bind-fail.ee24f95.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
bind-gate-guide-first.8538f29.png
Resource
win7-20230703-en
Behavioral task
behavioral31
Sample
bind-gate-guide-first.8538f29.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
bind-gate-guide-second.2ac19b6.png
Resource
win7-20230703-en
General
-
Target
alibaba_puhuiyi_bold.otf
-
Size
96KB
-
MD5
b88269075f30e1d116f4b31a37f172ee
-
SHA1
7db7fbc9b3a761cf114d6d96ebcf47c0009ed9f2
-
SHA256
3766116b78b74d07079158f2071a569fc2cfae21bd3a322af16ee841f5c5fb86
-
SHA512
8ba586d884507c00e8e73f0ffe6ae057deec35f469fcadc9c37a8a412bdcfedadf77efa816f8e7cad9f7103d97a83261100c95250759b32ffdabb982b442b1cb
-
SSDEEP
1536:GFqxFDEZ/eR6bdEF9aCI99xwgO131LXg/QIyVsEj80wzgwIe7z2qWuJQAg:GFWOZ/ekbdEF9F1g/S80oITJuJQAg
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 2856 wrote to memory of 2100 2856 cmd.exe fontview.exe PID 2856 wrote to memory of 2100 2856 cmd.exe fontview.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\alibaba_puhuiyi_bold.otf1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\alibaba_puhuiyi_bold.otf2⤵