Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2023, 07:44

General

  • Target

    公司营业执照复印件及法定代表人身份复印件pdf.exe

  • Size

    89KB

  • MD5

    7ac6761738d63d4c596a8315982f6299

  • SHA1

    61558316549ddbe6e0123baa2f9b4c995043f571

  • SHA256

    c4280cebb2542b61e82d44a1b8dd9ec6ff1063d3a33155641ce05148bb288ec8

  • SHA512

    562dd282b7959fe75347893362d58760b07828dede6935b4f5453d078d5aa0e9a85818d5c9dddb3076546b6d194ce2e270fdadf97dea1fad5ee2c1b2a5c821e6

  • SSDEEP

    768:0i7y2h1PBbr18KF70E5KtIqhcBv0UG0DU8woKGuSIB8t+pMs0GwfsrLL0tro:DO236tCcUz9HWrBZNwf8LL0lo

Malware Config

Extracted

Family

cobaltstrike

C2

http://218.12.86.80:443/static/skin/js/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Host: bmw.ccb.com

Extracted

Family

cobaltstrike

Botnet

0

C2

http://218.12.86.80:443/static/skin/js/jquery-3.3.1.min.js

http://221.228.216.78:443/static/skin/js/jquery-3.3.1.min.js

http://bmw.ccb.com.cdn.dnsv1.com.cn:443/static/skin/js/jquery-3.3.1.min.js

Attributes
  • access_type

    512

  • host

    218.12.86.80,/static/skin/js/jquery-3.3.1.min.js,221.228.216.78,/static/skin/js/jquery-3.3.1.min.js,bmw.ccb.com.cdn.dnsv1.com.cn,/static/skin/js/jquery-3.3.1.min.js

  • http_header1

    aWR2eVVhTURLdWJXVzRUTDNpUGpCdz09AAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    2048

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • unknown1

    4.234810624e+09

  • unknown2

    AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /static/skin/js/jquery-3.3.2.min.js

  • watermark

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\公司营业执照复印件及法定代表人身份复印件pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\公司营业执照复印件及法定代表人身份复印件pdf.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tmpCF6F.tmp.pdf"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1352

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabE035.tmp

          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

        • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

          Filesize

          3KB

          MD5

          a1cfdd5410fb15466dc708fa6653e314

          SHA1

          3b3d58b37c51c1c32fb16643f7eca5773fddc89a

          SHA256

          59fb3805e5babf215a61c3fb805b512fccb94438a28983aaa5de095283e34c4f

          SHA512

          fd11dda6e4b39f8360dd0a26e76d2acb5802f36db12769c522a749fe8699ec658a84bb5fea8f84b00b28aface380ea630b19fec69f6f85a0956ce9c703558c8d

        • memory/2324-53-0x000000013FF30000-0x000000013FF4A000-memory.dmp

          Filesize

          104KB

        • memory/2324-54-0x000007FEF60A0000-0x000007FEF6A8C000-memory.dmp

          Filesize

          9.9MB

        • memory/2324-72-0x000000001F450000-0x000000001F850000-memory.dmp

          Filesize

          4.0MB

        • memory/2324-71-0x000000001F850000-0x000000001FCC2000-memory.dmp

          Filesize

          4.4MB

        • memory/2324-88-0x000007FEF31F0000-0x000007FEF31F1000-memory.dmp

          Filesize

          4KB

        • memory/2324-89-0x000007FEF60A0000-0x000007FEF6A8C000-memory.dmp

          Filesize

          9.9MB

        • memory/2324-92-0x000000001F450000-0x000000001F850000-memory.dmp

          Filesize

          4.0MB