Overview
overview
10Static
static
3˳20...oc.lnk
windows7-x64
3˳20...oc.lnk
windows10-2004-x64
7˳20...�.xlsx
windows7-x64
1˳20...�.xlsx
windows10-2004-x64
1顺丰2023...rv.exe
windows7-x64
10顺丰2023...rv.exe
windows10-2004-x64
10顺丰2023...pt.vbs
windows7-x64
10顺丰2023...pt.vbs
windows10-2004-x64
10顺丰2023...nt.dll
windows7-x64
1顺丰2023...nt.dll
windows10-2004-x64
1Analysis
-
max time kernel
129s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31-08-2023 04:59
Static task
static1
Behavioral task
behavioral1
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
˳20234²Ա/20234²ԱԱ.doc.lnk
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
˳20234²Ա/嵥б/Ա嵥.xlsx
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win7-20230824-en
Behavioral task
behavioral6
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/NisSrv.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/apt.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
顺丰2023年4月裁员名单/清单列表/.__MACOSX__/闕ウ�ュ隴�/._MACOS_/mpclient.dll
Resource
win10v2004-20230703-en
General
-
Target
˳20234²Ա/20234²ԱԱ.doc.lnk
-
Size
1KB
-
MD5
c4273f81b467411ecf04f3d738ce7d46
-
SHA1
dbf01e0b38962457605f2ca6a0fe6cb0796606be
-
SHA256
223aa57937a946d01b70ee4d5be7862edf7923a8f8b8fbb2cbecfd836d786533
-
SHA512
69115a4d18cfea01a41adffae2d81a7be1bc65abf14f2b0cf16d99a00c60c3f6f71b2a48f9bcfe9736b6998b0cf0b893d2fdf510cccf3a08d14025cc23179304
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 18 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2932 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
explorer.exepid process 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe 2932 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2236 wrote to memory of 2968 2236 cmd.exe explorer.exe PID 2236 wrote to memory of 2968 2236 cmd.exe explorer.exe PID 2236 wrote to memory of 2968 2236 cmd.exe explorer.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\˳20234²Ա\20234²ԱԱ.doc.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ".\清单列表\.__MACOSX__\闕ウ�ュ隴�\._MACOS_\apt.vbs"2⤵PID:2968
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2932