Overview
overview
10Static
static
71111111111...11.exe
windows7-x64
61111111111...11.exe
windows10-1703-x64
61111111111...11.exe
windows10-2004-x64
69VIcoCiitn.exe
windows7-x64
69VIcoCiitn.exe
windows10-1703-x64
69VIcoCiitn.exe
windows10-2004-x64
1Microsoft Windows.exe
windows7-x64
10Microsoft Windows.exe
windows10-1703-x64
10Microsoft Windows.exe
windows10-2004-x64
10New.exe
windows7-x64
7New.exe
windows10-1703-x64
7New.exe
windows10-2004-x64
7SBLlgcMqPg.exe
windows7-x64
10SBLlgcMqPg.exe
windows10-1703-x64
10SBLlgcMqPg.exe
windows10-2004-x64
10hh.chm
windows7-x64
10hh.chm
windows10-1703-x64
8hh.chm
windows10-2004-x64
8nY4Ke1JkQH.exe
windows7-x64
10nY4Ke1JkQH.exe
windows10-1703-x64
10nY4Ke1JkQH.exe
windows10-2004-x64
10qnr.dll
windows7-x64
3qnr.dll
windows10-1703-x64
3qnr.dll
windows10-2004-x64
3˫װ.exe
windows7-x64
7˫װ.exe
windows10-1703-x64
7˫װ.exe
windows10-2004-x64
7�...װ.exe
windows7-x64
7�...װ.exe
windows10-1703-x64
7�...װ.exe
windows10-2004-x64
7Analysis
-
max time kernel
241s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2023, 09:07
Behavioral task
behavioral1
Sample
1111111111111111111111.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1111111111111111111111.exe
Resource
win10-20230915-en
Behavioral task
behavioral3
Sample
1111111111111111111111.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
9VIcoCiitn.exe
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
9VIcoCiitn.exe
Resource
win10-20230915-en
Behavioral task
behavioral6
Sample
9VIcoCiitn.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
Microsoft Windows.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Microsoft Windows.exe
Resource
win10-20230915-en
Behavioral task
behavioral9
Sample
Microsoft Windows.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
New.exe
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
New.exe
Resource
win10-20230915-en
Behavioral task
behavioral12
Sample
New.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
SBLlgcMqPg.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
SBLlgcMqPg.exe
Resource
win10-20230915-en
Behavioral task
behavioral15
Sample
SBLlgcMqPg.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
hh.chm
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
hh.chm
Resource
win10-20230915-en
Behavioral task
behavioral18
Sample
hh.chm
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
nY4Ke1JkQH.exe
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
nY4Ke1JkQH.exe
Resource
win10-20230915-en
Behavioral task
behavioral21
Sample
nY4Ke1JkQH.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
qnr.dll
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
qnr.dll
Resource
win10-20230915-en
Behavioral task
behavioral24
Sample
qnr.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
˫װ.exe
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
˫װ.exe
Resource
win10-20230915-en
Behavioral task
behavioral27
Sample
˫װ.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
ٷѰװ.exe
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
ٷѰװ.exe
Resource
win10-20230831-en
Behavioral task
behavioral30
Sample
ٷѰװ.exe
Resource
win10v2004-20230915-en
General
-
Target
1111111111111111111111.exe
-
Size
288KB
-
MD5
ba36525430720564c0ff6db7c7f527d5
-
SHA1
2a01ef1171726e56c01a6c773ec3b9a92ac7162b
-
SHA256
a9317d8db186396a1a570f1dea184b94ddd2a6d2f7c381c563e0e745c0f8cc16
-
SHA512
0f0cf60a3148dba434509ec34934df663b0d24cceff70d2368b37277cd69752202c55289874e42bdd216f3610530f50fe79336064fb1f6a6ed0927eb8a9567f0
-
SSDEEP
3072:m4jPfhWV9XBb0MAtrg0OoHpFcNTXT2pTnhR1g2br54Qun9UItLpCEcbqGpYl7WUB:m4jUXB0MZDoJFcp0pgI6QkUIcbpO5zx
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 1111111111111111111111.exe File opened (read-only) \??\J: 1111111111111111111111.exe File opened (read-only) \??\K: 1111111111111111111111.exe File opened (read-only) \??\P: 1111111111111111111111.exe File opened (read-only) \??\Q: 1111111111111111111111.exe File opened (read-only) \??\U: 1111111111111111111111.exe File opened (read-only) \??\V: 1111111111111111111111.exe File opened (read-only) \??\Z: 1111111111111111111111.exe File opened (read-only) \??\O: 1111111111111111111111.exe File opened (read-only) \??\W: 1111111111111111111111.exe File opened (read-only) \??\B: 1111111111111111111111.exe File opened (read-only) \??\G: 1111111111111111111111.exe File opened (read-only) \??\H: 1111111111111111111111.exe File opened (read-only) \??\L: 1111111111111111111111.exe File opened (read-only) \??\N: 1111111111111111111111.exe File opened (read-only) \??\R: 1111111111111111111111.exe File opened (read-only) \??\S: 1111111111111111111111.exe File opened (read-only) \??\Y: 1111111111111111111111.exe File opened (read-only) \??\I: 1111111111111111111111.exe File opened (read-only) \??\M: 1111111111111111111111.exe File opened (read-only) \??\T: 1111111111111111111111.exe File opened (read-only) \??\X: 1111111111111111111111.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe 4252 1111111111111111111111.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4252 1111111111111111111111.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4252 1111111111111111111111.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4252 1111111111111111111111.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4252 wrote to memory of 3972 4252 1111111111111111111111.exe 92 PID 4252 wrote to memory of 3972 4252 1111111111111111111111.exe 92 PID 4252 wrote to memory of 3972 4252 1111111111111111111111.exe 92 PID 4252 wrote to memory of 3972 4252 1111111111111111111111.exe 92 PID 4252 wrote to memory of 3972 4252 1111111111111111111111.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1111111111111111111111.exe"C:\Users\Admin\AppData\Local\Temp\1111111111111111111111.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe2⤵PID:3972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5df3db2c115f5cb062552218b7e1a0e3a
SHA154c8154915aa9a3e961b1fa00813ae1f455f91d8
SHA256a43b922967a0e5e56455fd19d8d0c5161865637a83522b37d6318913b76e5e93
SHA51270f4f0bab3ff54f5696cd25b5a9de0347f06be3b9b73d3d63c5de068a3373c0b0c31c1897c9ab4d3f8c63dff636f26337d68ea0616f7c1da3c2ec172a54b06d2