Overview
overview
7Static
static
3HTTP Debug...en.exe
windows7-x64
1HTTP Debug...en.exe
windows10-2004-x64
1HTTP Debug...ro.msi
windows7-x64
7HTTP Debug...ro.msi
windows10-2004-x64
7HTTP Debug...UI.exe
windows7-x64
1HTTP Debug...UI.exe
windows10-2004-x64
1六六工具箱.url
windows7-x64
1六六工具箱.url
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
HTTP Debugger 9.10/Crack/keygen.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
HTTP Debugger 9.10/Crack/keygen.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
HTTP Debugger 9.10/HTTPDebuggerPro.msi
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
HTTP Debugger 9.10/HTTPDebuggerPro.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
HTTP Debugger 9.10/汉化补丁/HTTPDebuggerUI.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral6
Sample
HTTP Debugger 9.10/汉化补丁/HTTPDebuggerUI.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
六六工具箱.url
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral8
Sample
六六工具箱.url
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
HTTP Debugger 9.10/HTTPDebuggerPro.msi
-
Size
10.3MB
-
MD5
f2877e684b78d8ce0606a5560bc4a6d6
-
SHA1
3962aea5eebff7a1be8321b6d4feef64ae578b82
-
SHA256
d8965c3ee41afdd1107406e5bff609408c2979231618ebf64cf6c90266150a29
-
SHA512
bc76d08b433bfc099295c195e65fad27964b641de74279e37b147f8be469313ed54e3bde62109e7c6fae4683974292e9de5d75d816abe2f06ab1bd93cd9b7101
-
SSDEEP
196608:4DjKEDfNxRiRQEMyyPxHFY3So/vkYduV0m4W4wET9yZ9p2L8zB:4DjKCf7kWEMyyjCcYu25T9s9MK
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2236 MsiExec.exe 2236 MsiExec.exe 2236 MsiExec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1736 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1736 msiexec.exe Token: SeIncreaseQuotaPrivilege 1736 msiexec.exe Token: SeRestorePrivilege 2084 msiexec.exe Token: SeTakeOwnershipPrivilege 2084 msiexec.exe Token: SeSecurityPrivilege 2084 msiexec.exe Token: SeCreateTokenPrivilege 1736 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1736 msiexec.exe Token: SeLockMemoryPrivilege 1736 msiexec.exe Token: SeIncreaseQuotaPrivilege 1736 msiexec.exe Token: SeMachineAccountPrivilege 1736 msiexec.exe Token: SeTcbPrivilege 1736 msiexec.exe Token: SeSecurityPrivilege 1736 msiexec.exe Token: SeTakeOwnershipPrivilege 1736 msiexec.exe Token: SeLoadDriverPrivilege 1736 msiexec.exe Token: SeSystemProfilePrivilege 1736 msiexec.exe Token: SeSystemtimePrivilege 1736 msiexec.exe Token: SeProfSingleProcessPrivilege 1736 msiexec.exe Token: SeIncBasePriorityPrivilege 1736 msiexec.exe Token: SeCreatePagefilePrivilege 1736 msiexec.exe Token: SeCreatePermanentPrivilege 1736 msiexec.exe Token: SeBackupPrivilege 1736 msiexec.exe Token: SeRestorePrivilege 1736 msiexec.exe Token: SeShutdownPrivilege 1736 msiexec.exe Token: SeDebugPrivilege 1736 msiexec.exe Token: SeAuditPrivilege 1736 msiexec.exe Token: SeSystemEnvironmentPrivilege 1736 msiexec.exe Token: SeChangeNotifyPrivilege 1736 msiexec.exe Token: SeRemoteShutdownPrivilege 1736 msiexec.exe Token: SeUndockPrivilege 1736 msiexec.exe Token: SeSyncAgentPrivilege 1736 msiexec.exe Token: SeEnableDelegationPrivilege 1736 msiexec.exe Token: SeManageVolumePrivilege 1736 msiexec.exe Token: SeImpersonatePrivilege 1736 msiexec.exe Token: SeCreateGlobalPrivilege 1736 msiexec.exe Token: SeCreateTokenPrivilege 1736 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1736 msiexec.exe Token: SeLockMemoryPrivilege 1736 msiexec.exe Token: SeIncreaseQuotaPrivilege 1736 msiexec.exe Token: SeMachineAccountPrivilege 1736 msiexec.exe Token: SeTcbPrivilege 1736 msiexec.exe Token: SeSecurityPrivilege 1736 msiexec.exe Token: SeTakeOwnershipPrivilege 1736 msiexec.exe Token: SeLoadDriverPrivilege 1736 msiexec.exe Token: SeSystemProfilePrivilege 1736 msiexec.exe Token: SeSystemtimePrivilege 1736 msiexec.exe Token: SeProfSingleProcessPrivilege 1736 msiexec.exe Token: SeIncBasePriorityPrivilege 1736 msiexec.exe Token: SeCreatePagefilePrivilege 1736 msiexec.exe Token: SeCreatePermanentPrivilege 1736 msiexec.exe Token: SeBackupPrivilege 1736 msiexec.exe Token: SeRestorePrivilege 1736 msiexec.exe Token: SeShutdownPrivilege 1736 msiexec.exe Token: SeDebugPrivilege 1736 msiexec.exe Token: SeAuditPrivilege 1736 msiexec.exe Token: SeSystemEnvironmentPrivilege 1736 msiexec.exe Token: SeChangeNotifyPrivilege 1736 msiexec.exe Token: SeRemoteShutdownPrivilege 1736 msiexec.exe Token: SeUndockPrivilege 1736 msiexec.exe Token: SeSyncAgentPrivilege 1736 msiexec.exe Token: SeEnableDelegationPrivilege 1736 msiexec.exe Token: SeManageVolumePrivilege 1736 msiexec.exe Token: SeImpersonatePrivilege 1736 msiexec.exe Token: SeCreateGlobalPrivilege 1736 msiexec.exe Token: SeCreateTokenPrivilege 1736 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29 PID 2084 wrote to memory of 2236 2084 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\HTTP Debugger 9.10\HTTPDebuggerPro.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1736
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C78EC1B15971B299DBCF03A12742D417 C2⤵
- Loads dropped DLL
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627