d7328efeb259c12686d5797c9abcf0fad794ca7b9361f0517027c71b58b42347

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

--点我安装--.exe
Size

2.5MB
MD5

bfee567e1324a2398e6701300336a58a
SHA1

7a6c12a1d7df9828e7d43e610c34ec8a3dbae0e0
SHA256

e396b71edd7c534085151494e5fe185921c12212ac43d7ae1db39f7a7a9f77b9
SHA512

019ed96e1986867f7de6f9520bbc56b32347065613ff4e7f5337c79f888d2ffd0ace1890bedf771f9b576c80749cf195a200928a93aa63fa3764d835bf4c46e2
SSDEEP

49152:Megwd60SregclSHbVdGNJzHBoIyxkYJm/QxKE:Mbwd6Pre2HZdGNFBoIRYyfE

Score

8^/10

evasion ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\×ÀÃæ±³¾°Í¼Æ¬.bmp"	--点我安装--.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\×ÀÃæ±³¾°Í¼Æ¬.bmp	--点我安装--.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\Desktop\WallpaperStyle = "0"	--点我安装--.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\Desktop\TileWallpaper = "1"	--点我安装--.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	--点我安装--.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Policies\System	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	--点我安装--.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	--点我安装--.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3100	--点我安装--.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe
3100	--点我安装--.exe

C:\Users\Admin\AppData\Local\Temp\--点我安装--.exe
"C:\Users\Admin\AppData\Local\Temp\--点我安装--.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact