Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
03-08-2023 11:52
General
-
Target
Nishikigi/云通登录端%p.exe
-
Size
179KB
-
MD5
fffedf97b0e3f51bb6c7d0027adc5757
-
SHA1
da9a918a8cbc13906909745d2952f768be243abd
-
SHA256
0559217e7c7af4ac5f251b586d7cfe22fc360c0eafbb34af4230bbc7c952e302
-
SHA512
b6e1c146a430daa9010ec6f05e4b061ed149ed3ccaa887099c14045c3241a034cbcac9a0e8959256d309f62493ed01bf028cda8ece90053a8ec892acdd742f67
-
SSDEEP
3072:XANQiRlneHvgD+7KD4b0MVwxLnEE84LWSmoY46GKXIl8GhlKxA:XA/RBeHvgD+mDS0BLEE9cohkXq8Sp
Malware Config
Signatures
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nishikigi\云通登录端%p.exe"C:\Users\Admin\AppData\Local\Temp\Nishikigi\云通登录端%p.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\MPGXZSXX\MPGXZSXX.exe"C:\MPGXZSXX\MPGXZSXX.exe" -hj2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\edaa\phqghumeay\phqghumeay.exe"C:\edaa\phqghumeay\phqghumeay.exe" C:\edaa\phqghumeay\phqghumeay.zip -d C:\Users\Admin\AppData\Roaming1⤵
- Drops startup file
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270KB
MD52db518107c8b5a29dc74547773e3b07a
SHA159825db2c530d315fc7c549e6c80a9d4b0a5d2e4
SHA2569c1ebc705ba6911653d98d281636bad39e172f971552ee419a3189a3dc184a61
SHA51212ddea2400882400bd2ec2ca18142d673ec30d1af8999f112b4f5e9aeab60d437f7d4aa07dd9b9e4d08f8f90dc1e3ebdb08a77aea63068491d3d2790899276bc
-
Filesize
64KB
MD5c9ec8833f64bb6a06996243a88228740
SHA1204dd511031fbceee22e56be66242129d3044534
SHA256876aaff08167deb6c75c4091bc146dcd63df1006d3586273fa45c56a37945549
SHA512d6e796c2f43377d2fa00dc5238c5dbe7635b2e6aa0e50309b5749c1ae4df736add95782e697c70e116d74f8722a387c4a9d00fb5165e0da7351b06886ff628a7
-
Filesize
64KB
MD5c9ec8833f64bb6a06996243a88228740
SHA1204dd511031fbceee22e56be66242129d3044534
SHA256876aaff08167deb6c75c4091bc146dcd63df1006d3586273fa45c56a37945549
SHA512d6e796c2f43377d2fa00dc5238c5dbe7635b2e6aa0e50309b5749c1ae4df736add95782e697c70e116d74f8722a387c4a9d00fb5165e0da7351b06886ff628a7
-
Filesize
1.7MB
MD56eef52f5fc71c0aec40ec5d9632500f5
SHA19bd31aafa1caa9c88b0c8c041819d322f9e36ff7
SHA2562421a60b89995fc9ab83e8121595a573ef663a2b5226a668b7bb7d82dd35040d
SHA51204a967276a8f545379ff391193b7a799351ec469dff1bdec984b2b354b1bb3143d7450afc54de43a62ac780c0880f16ca3e1ec539e3300cca5f493a4393da1a4
-
Filesize
34B
MD53a9e6f4a8bcf335a1ae23af2a3dcc467
SHA1db54dfd712bc21445759dbcd1c6e14d279418810
SHA256312cd38302f393b930004ac1038f6804a3fc9b0b5c93455ed8e5b254b56f305c
SHA512a3d20604df640c56df2c465a8d6da407660c5a9105399e315ba1bc736340fdc7fe83dcf15917a7839611575b8498827cff6a30f1f370385d148c5fd9572dc632
-
Filesize
216KB
MD5d976a3cfe0eb543955c205f5dd290034
SHA15f02716608aa7ef2c412003639d5dc1a27f8b7d0
SHA256b306883d57ecef624d10083e9b75d452e1365770e9d196589688a1f996a6813e
SHA512f854ae30943e601fa3f7aaa64062dd6ae1a0be3f2d3603631092ba03ae4706e83ebfb9de2e7d23d92820627d5b5af3c81dff262b1aa96d797f97f4c7327d63f9
-
Filesize
1KB
MD5157675d427f9c1fa965684d445b1fc24
SHA1cfa77184a285f794f761febb5ec6867381ac6a81
SHA256ec5fccce519161a9b43a5fc603c655399c02ebfb49015f9519ff98e080c31886
SHA512b55e0abedc5b7bb6ba5e0bb2a51092766a5698571bf6797de89d999608a3812c017bdbf1e7447b7a759fc24d13b7a41b0198ea163b18dfe2318d6a3b7fd836b4
-
Filesize
270KB
MD52db518107c8b5a29dc74547773e3b07a
SHA159825db2c530d315fc7c549e6c80a9d4b0a5d2e4
SHA2569c1ebc705ba6911653d98d281636bad39e172f971552ee419a3189a3dc184a61
SHA51212ddea2400882400bd2ec2ca18142d673ec30d1af8999f112b4f5e9aeab60d437f7d4aa07dd9b9e4d08f8f90dc1e3ebdb08a77aea63068491d3d2790899276bc
-
Filesize
216KB
MD5d976a3cfe0eb543955c205f5dd290034
SHA15f02716608aa7ef2c412003639d5dc1a27f8b7d0
SHA256b306883d57ecef624d10083e9b75d452e1365770e9d196589688a1f996a6813e
SHA512f854ae30943e601fa3f7aaa64062dd6ae1a0be3f2d3603631092ba03ae4706e83ebfb9de2e7d23d92820627d5b5af3c81dff262b1aa96d797f97f4c7327d63f9
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
256KB
-
Filesize
256KB