Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
11-08-2023 00:56
General
-
Target
关于调整北部湾航空基层干部员工2023年7月份绩效考核结果的通知.exe
-
Size
2.5MB
-
MD5
404357e3f4b8f6edb0cf09e45b1196cd
-
SHA1
9d96b73760b3befeadb0da66a6f807d99300311a
-
SHA256
b3adf38a949bfa704da093f0a23aa8b50c59533c4a0166992264c1bc1c40a78c
-
SHA512
ec323ff581780f3337ae324529bfa3f5d83e4a17bf40000b1eaab2332626d62aba1833ebf2f1d48adf228a730325d27cf9e1383410180d6c3bf483de25fd81fc
-
SSDEEP
24576:WWzffWyRde1K/sjcsx3E1PpvMGV5iJ2ynThaft7gDC4HDo:nCqdeesj3x3E118F0gXH8
Malware Config
Extracted
cobaltstrike
0
-
watermark
0
Extracted
cobaltstrike
1234567890
http://static.cgbchina.com.cn.cloud.360.net.cdn.dnsv1.com:443/Display/chan/IB61I7MYA
-
access_type
512
-
beacon_type
2048
-
host
static.cgbchina.com.cn.cloud.360.net.cdn.dnsv1.com,/Display/chan/IB61I7MYA
-
http_header1
AAAACgAAAEBBY2NlcHQ6IGFwcGxpY2F0aW9uL3htbCwgYXBwbGljYXRpb24veGh0bWwreG1sLCBhcHBsaWNhdGlvbi9qc29uAAAACgAAABNBY2NlcHQtTGFuZ3VhZ2U6IGFmAAAACgAAABxBY2NlcHQtRW5jb2Rpbmc6ICosIGNvbXByZXNzAAAABwAAAAAAAAAPAAAADQAAAAIAAAArc2VjdXJlX2lkX0VaUlBaM0VMOTVQMjEzRVdUWVNNWlRFMzFQVDg2TFlIPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAADJBY2NlcHQ6IGltYWdlLyosIGFwcGxpY2F0aW9uL2pzb24sIGFwcGxpY2F0aW9uL3htbAAAAAoAAAAWQWNjZXB0LUxhbmd1YWdlOiBlbi1nYgAAAAoAAAAdQWNjZXB0LUVuY29kaW5nOiBiciwgY29tcHJlc3MAAAAHAAAAAAAAAA8AAAANAAAABQAAAAlfQ0FLTlJIUksAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
12800
-
polling_time
10000
-
port_number
443
-
sc_process32
%windir%\syswow64\WUAUCLT.exe
-
sc_process64
%windir%\sysnative\grpconv.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu0/9/fReMVIpceknp4dAotonYcQjTuErQMUbYY5YT/85fx7zssf1MATf/Dh0SSWjMWfQkq4wqQ0jIKdY72SVDEv/DqPpPxlDA5wNubksLitOVh1NGqr0b8bAgigeGguWcJxsFO+1gY/mjW9GnZGvMt0k5uX3NCsJzL1fpIwLDLQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
8.72947712e+08
-
unknown2
AAAABAAAAAEAAASeAAAAAgAAA44AAAAIAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/Compute/deployment/VGJZ0HOE8UX5
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.80 Safari/537.36
-
watermark
1234567890
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 31 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\关于调整北部湾航空基层干部员工2023年7月份绩效考核结果的通知.exe"C:\Users\Admin\AppData\Local\Temp\关于调整北部湾航空基层干部员工2023年7月份绩效考核结果的通知.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /k "start /b" C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_fcekea.docx2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\tmp_fcekea.docx" /o ""3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5004805a810faa2af438a2fa9082f316f
SHA115cdec937f1e48bdbe59899d709a3f0f08e76a2c
SHA2569f92df6da42a42517a509e51ac1088daa6d2ed455dafca851a40353c4b51a527
SHA51263ad6d0ba02a9b9f6fd861dafda34d280c52711c4ca868735b155ad0022fc26a795c57a1b8aacf60ce4015e0a64ffe2dd8040e2be30ce721e5e56209f3d1113f
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1024KB
-
Filesize
316KB
-
Filesize
264KB
-
Filesize
316KB
-
Filesize
1024KB
-
Filesize
316KB
-
Filesize
2.8MB
-
Filesize
264KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB