Overview

overview

10

Static

static

1

TseFDup.msi

windows7-x64

8

TseFDup.msi

windows10-1703-x64

8

TseFDup.msi

windows10-2004-x64

8

desk-zhonw....9.msi

windows7-x64

10

desk-zhonw....9.msi

windows10-1703-x64

10

desk-zhonw....9.msi

windows10-2004-x64

7

py-hzz.msi

windows7-x64

10

py-hzz.msi

windows10-1703-x64

10

py-hzz.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    166s
  • platform
    windows10-1703_x64
  • resource
    win10-20230831-en
  • resource tags

    arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-09-2023 04:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    py-hzz.msi

  • Size

    118.5MB

  • MD5

    647864bf491144519120e6aef0ccee2b

  • SHA1

    aa0f4f5ae485cc31c80d1241442bd07710db353e

  • SHA256

    1e87ebcf8bf36d40079573ee61efb7f4e7f70b46c85ca1888899490b4be5f98d

  • SHA512

    12bdbed6a35d0c22e3266f1356ad8261d66d539be4e344084aeb7a3d05d438081ffd328ba6da9028f745b17e50af96b27e80ebc7cec2969acda308657c7019c1

  • SSDEEP

    3145728:n92fD6MoAr3Z1q3oeZJDN/Mfm1eoT1Fl0f5yQBtmpX4:gfD6Moc3a3oeZnMGBRsdtmR

Score
10/10
blackmoonbankertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\py-hzz.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3416
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4260
    • C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe
      "C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe" /Install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:832
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1888
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe
    Filesize

    3.0MB

    MD5

    1e1b42b6c885280e082ac373f7b59f3f

    SHA1

    1e6646b827f5089aefedac669f62ef55a19d7ad2

    SHA256

    14b6a49fb11961fb851c51b3dbca5ee8cb02d86e5dfcf7cdbd9edcd06f2c118c

    SHA512

    56826f422d8f68d6c9a6b7cd23c0a48fa7ee48c4e90588f630d4b08588b63e8cfff230549272d8411cd2fe229f158ddc108a48cba658064ded4e76e0d9064c64

    Download Submit

  • C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe
    Filesize

    3.0MB

    MD5

    1e1b42b6c885280e082ac373f7b59f3f

    SHA1

    1e6646b827f5089aefedac669f62ef55a19d7ad2

    SHA256

    14b6a49fb11961fb851c51b3dbca5ee8cb02d86e5dfcf7cdbd9edcd06f2c118c

    SHA512

    56826f422d8f68d6c9a6b7cd23c0a48fa7ee48c4e90588f630d4b08588b63e8cfff230549272d8411cd2fe229f158ddc108a48cba658064ded4e76e0d9064c64

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMAQ31I9\316QTH8A.htm
    Filesize

    399KB

    MD5

    e1f5dd5bea1103d26aab7b89c972c17d

    SHA1

    caed777d77c0aee0eb020add009bde63eb6a3130

    SHA256

    ce868a2b5236eff4601f32a88fa69d9f45901cce80cd18dd174e7ddf549ba7d6

    SHA512

    d2c347c94e165e78e606116147cbed98b87a320ba32029fb50d08d8005f2203e0a77666d360dd6a109340ea0dfbdb14089703029cacd155fb84e57c64b4423b5

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    25.0MB

    MD5

    1735abeff2ebe939a58a6a155b31a7c8

    SHA1

    74df135a9ca4521ff11ff358b747379d77c91b99

    SHA256

    ea740687a45b848f03de2ec3ae029b24f8ab182a1a13a5b259cd6f03ae742917

    SHA512

    2b2a79aafc0c3003d27cc1635b06a896552dd3e63a6ccb2eccd46217e258e2f1247c9584d1d7451659e4d984b3424a705d7c6ac1c99bc46af04ee74f0552459f

    Download Submit

  • \??\Volume{c1bf55be-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6f7f6092-e144-4d59-b93b-377c376cd0e5}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    13e264ce690d8294acabf84c0f97013f

    SHA1

    ccf9b4f749c36822a9665a71f8fa60f1fd3301ac

    SHA256

    73911544d3f2d1cf564ff9b794ad43c22c47295c2781459497f4c9d05814cb83

    SHA512

    a16c9dec649e83a2965dd0a4e894d6ac58ce3aa92118a86730d1afd56c607990dbea1c31f735c720ec7c773f97ccf06bf618c74b1bb140f7ce982b97bb382f8d

    Download Submit

  • \Users\Public\Videos\study89\1.dll
    Filesize

    1.9MB

    MD5

    efb4f7f2c29f4b812ec344782c751ead

    SHA1

    84e6ec5323d1c535dcf4c7bbdde259a9847eee39

    SHA256

    d48fb613b4336547f5925f88ffd5de78bb36974634aad096deeb5af4be1b96c6

    SHA512

    dc85c2005c84da617bf2280471db7afb4e4bb3f85aa885136b6daf14041ee6d0dd4afd043ac1d16e4b14eddc05ad93aa8e2dec55d1e8e22e05427666cfb2c4c4

    Download Submit

  • \Users\Public\Videos\study89\2.dll
    Filesize

    576KB

    MD5

    e1b3cf30274e632c35be299d4d6e3931

    SHA1

    9c52dccc089995899c566d1897d4b6e623c790b6

    SHA256

    37987d399b9d543125909768f6197783fe8ea92d2575622ae3df9e396444f6fd

    SHA512

    1b9475c430d70cd18097849d5eecd1d41493811f7162ca89cc29ce87093b7261e9c594567d9b39cf49157e6feb50f0f014ca93d5923fe124bafe9504db976443

    Download Submit