Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2023, 02:16

General

  • Target

    663b5f9cc1c8c974a7651cdd6a720a7bc77a59c01b8d27274a504340666fd322.exe

  • Size

    1.9MB

  • MD5

    590b1a7d37d12106e1dbcfd063b23398

  • SHA1

    789e25388a35a54fcf3f956cd582fa5c4ab3f595

  • SHA256

    663b5f9cc1c8c974a7651cdd6a720a7bc77a59c01b8d27274a504340666fd322

  • SHA512

    9c6736ee2181f91630e2208fd70f3097a6d590f3b1c822d6ad0e518d4643cf453269549435e693ff8cd6038cd1274c42d8bb4473e863fa7adb49f80f3aae9a96

  • SSDEEP

    49152:cP0K1HDEsdSiopguI125iZblH7PJdR0ebbau1m:y71HDEfHgB7PJdnw

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\663b5f9cc1c8c974a7651cdd6a720a7bc77a59c01b8d27274a504340666fd322.exe
    "C:\Users\Admin\AppData\Local\Temp\663b5f9cc1c8c974a7651cdd6a720a7bc77a59c01b8d27274a504340666fd322.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2416
  • C:\mina\waike.exe
    "C:\mina\waike.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Public\xiaodaxzqxia\n.bat
      2⤵
        PID:1704
      • C:\Users\Public\xiaodaxzqxia\v.exe
        "C:\Users\Public\xiaodaxzqxia\v.exe" x 111 -y
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Public\xiaodaxzqxia\v.bat
        2⤵
          PID:2072
      • C:\Windows\hh.exe
        "C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\9755444187291871\A11.chm
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1980
      • C:\Windows\hh.exe
        "C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\9755444187291871\A11.chm
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2732

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat

        Filesize

        8KB

        MD5

        57461b234b2a75ce813cf6144996c5e8

        SHA1

        1ea8277e245640f60bda92182edc9bcc3107aea6

        SHA256

        e21679de70ebbe36c9fe3f3618992e97c44180bb81da959df9f48202bad51e01

        SHA512

        14e2127a8034f265958ce1b80c315770d3ae221ac715a7b6577714d423beab8e0a89a0ad89a63bc28d60a9c3d406755e96a998de33821be797fe843009dfdd7c

      • C:\Users\Public\cxzvasdfg\9755444187291871\A11.chm

        Filesize

        9KB

        MD5

        2342b3ba19855ddd8c3e311b2842bdbb

        SHA1

        ecec63f62d445bdcc369af3f29df566611c7d4a5

        SHA256

        257c340891c8007dbb720853244785b8d7433fb70ca0038528b9fde035d0bfe6

        SHA512

        f5230c860656004d8f860f5b2941b15519cebf7ce6494eefcea6307be4057f5cd6178cbdfca9a022d28fd11cc0d81ed1f2a719ff9a614e28a0eb12f048302cb9

      • C:\Users\Public\xiaodaxzqxia\111

        Filesize

        18B

        MD5

        11bc70016f1fde86d2cdce0846a5076f

        SHA1

        d01eb4d8423b89b743643b80b1fb8e649cbad4e5

        SHA256

        94568641d14104f957b438b273187700590b63f0c22f52235d8e5b77233efd3c

        SHA512

        e4a25b57d4b682d08911a693ff0fcffc7f3cabbe60d820105f1fc47bd8b7c1740ab371e1ef7f94d5b6b2811d5dc3f4af2c382ee91fe4ba614384e405cd114da1

      • C:\Users\Public\xiaodaxzqxia\7z.dll

        Filesize

        1.2MB

        MD5

        a65e53c974a4e61728ecb632339a0978

        SHA1

        27e6ec4f8e34b40f1e08503245700c182b918ce9

        SHA256

        ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

        SHA512

        b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

      • C:\Users\Public\xiaodaxzqxia\n.bat

        Filesize

        18B

        MD5

        11bc70016f1fde86d2cdce0846a5076f

        SHA1

        d01eb4d8423b89b743643b80b1fb8e649cbad4e5

        SHA256

        94568641d14104f957b438b273187700590b63f0c22f52235d8e5b77233efd3c

        SHA512

        e4a25b57d4b682d08911a693ff0fcffc7f3cabbe60d820105f1fc47bd8b7c1740ab371e1ef7f94d5b6b2811d5dc3f4af2c382ee91fe4ba614384e405cd114da1

      • C:\Users\Public\xiaodaxzqxia\n.bat

        Filesize

        18B

        MD5

        11bc70016f1fde86d2cdce0846a5076f

        SHA1

        d01eb4d8423b89b743643b80b1fb8e649cbad4e5

        SHA256

        94568641d14104f957b438b273187700590b63f0c22f52235d8e5b77233efd3c

        SHA512

        e4a25b57d4b682d08911a693ff0fcffc7f3cabbe60d820105f1fc47bd8b7c1740ab371e1ef7f94d5b6b2811d5dc3f4af2c382ee91fe4ba614384e405cd114da1

      • C:\Users\Public\xiaodaxzqxia\v.bat

        Filesize

        18B

        MD5

        11bc70016f1fde86d2cdce0846a5076f

        SHA1

        d01eb4d8423b89b743643b80b1fb8e649cbad4e5

        SHA256

        94568641d14104f957b438b273187700590b63f0c22f52235d8e5b77233efd3c

        SHA512

        e4a25b57d4b682d08911a693ff0fcffc7f3cabbe60d820105f1fc47bd8b7c1740ab371e1ef7f94d5b6b2811d5dc3f4af2c382ee91fe4ba614384e405cd114da1

      • C:\Users\Public\xiaodaxzqxia\v.exe

        Filesize

        329KB

        MD5

        62d2156e3ca8387964f7aa13dd1ccd5b

        SHA1

        a5067e046ed9ea5512c94d1d17c394d6cf89ccca

        SHA256

        59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

        SHA512

        006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

      • C:\mina\waike.exe

        Filesize

        1.9MB

        MD5

        590b1a7d37d12106e1dbcfd063b23398

        SHA1

        789e25388a35a54fcf3f956cd582fa5c4ab3f595

        SHA256

        663b5f9cc1c8c974a7651cdd6a720a7bc77a59c01b8d27274a504340666fd322

        SHA512

        9c6736ee2181f91630e2208fd70f3097a6d590f3b1c822d6ad0e518d4643cf453269549435e693ff8cd6038cd1274c42d8bb4473e863fa7adb49f80f3aae9a96

      • \Users\Public\xiaodaxzqxia\7z.dll

        Filesize

        1.2MB

        MD5

        a65e53c974a4e61728ecb632339a0978

        SHA1

        27e6ec4f8e34b40f1e08503245700c182b918ce9

        SHA256

        ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

        SHA512

        b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

      • \Users\Public\xiaodaxzqxia\v.exe

        Filesize

        329KB

        MD5

        62d2156e3ca8387964f7aa13dd1ccd5b

        SHA1

        a5067e046ed9ea5512c94d1d17c394d6cf89ccca

        SHA256

        59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

        SHA512

        006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

      • memory/2416-0-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2416-8-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2416-6-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2644-10-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2644-9-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2644-38-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2644-55-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB

      • memory/2644-4-0x0000000000400000-0x000000000085F000-memory.dmp

        Filesize

        4.4MB