Overview
overview
7Static
static
3HTTP Debug...en.exe
windows7-x64
1HTTP Debug...en.exe
windows10-2004-x64
1HTTP Debug...ro.msi
windows7-x64
7HTTP Debug...ro.msi
windows10-2004-x64
7HTTP Debug...UI.exe
windows7-x64
1HTTP Debug...UI.exe
windows10-2004-x64
1六六工具箱.url
windows7-x64
1六六工具箱.url
windows10-2004-x64
1Analysis
-
max time kernel
210s -
max time network
243s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2023 11:13
Static task
static1
Behavioral task
behavioral1
Sample
HTTP Debugger 9.10/Crack/keygen.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
HTTP Debugger 9.10/Crack/keygen.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
HTTP Debugger 9.10/HTTPDebuggerPro.msi
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
HTTP Debugger 9.10/HTTPDebuggerPro.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
HTTP Debugger 9.10/汉化补丁/HTTPDebuggerUI.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral6
Sample
HTTP Debugger 9.10/汉化补丁/HTTPDebuggerUI.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
六六工具箱.url
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral8
Sample
六六工具箱.url
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
HTTP Debugger 9.10/HTTPDebuggerPro.msi
-
Size
10.3MB
-
MD5
f2877e684b78d8ce0606a5560bc4a6d6
-
SHA1
3962aea5eebff7a1be8321b6d4feef64ae578b82
-
SHA256
d8965c3ee41afdd1107406e5bff609408c2979231618ebf64cf6c90266150a29
-
SHA512
bc76d08b433bfc099295c195e65fad27964b641de74279e37b147f8be469313ed54e3bde62109e7c6fae4683974292e9de5d75d816abe2f06ab1bd93cd9b7101
-
SSDEEP
196608:4DjKEDfNxRiRQEMyyPxHFY3So/vkYduV0m4W4wET9yZ9p2L8zB:4DjKCf7kWEMyyjCcYu25T9s9MK
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 37 3660 msiexec.exe 41 3660 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3660 msiexec.exe Token: SeIncreaseQuotaPrivilege 3660 msiexec.exe Token: SeSecurityPrivilege 852 msiexec.exe Token: SeCreateTokenPrivilege 3660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3660 msiexec.exe Token: SeLockMemoryPrivilege 3660 msiexec.exe Token: SeIncreaseQuotaPrivilege 3660 msiexec.exe Token: SeMachineAccountPrivilege 3660 msiexec.exe Token: SeTcbPrivilege 3660 msiexec.exe Token: SeSecurityPrivilege 3660 msiexec.exe Token: SeTakeOwnershipPrivilege 3660 msiexec.exe Token: SeLoadDriverPrivilege 3660 msiexec.exe Token: SeSystemProfilePrivilege 3660 msiexec.exe Token: SeSystemtimePrivilege 3660 msiexec.exe Token: SeProfSingleProcessPrivilege 3660 msiexec.exe Token: SeIncBasePriorityPrivilege 3660 msiexec.exe Token: SeCreatePagefilePrivilege 3660 msiexec.exe Token: SeCreatePermanentPrivilege 3660 msiexec.exe Token: SeBackupPrivilege 3660 msiexec.exe Token: SeRestorePrivilege 3660 msiexec.exe Token: SeShutdownPrivilege 3660 msiexec.exe Token: SeDebugPrivilege 3660 msiexec.exe Token: SeAuditPrivilege 3660 msiexec.exe Token: SeSystemEnvironmentPrivilege 3660 msiexec.exe Token: SeChangeNotifyPrivilege 3660 msiexec.exe Token: SeRemoteShutdownPrivilege 3660 msiexec.exe Token: SeUndockPrivilege 3660 msiexec.exe Token: SeSyncAgentPrivilege 3660 msiexec.exe Token: SeEnableDelegationPrivilege 3660 msiexec.exe Token: SeManageVolumePrivilege 3660 msiexec.exe Token: SeImpersonatePrivilege 3660 msiexec.exe Token: SeCreateGlobalPrivilege 3660 msiexec.exe Token: SeCreateTokenPrivilege 3660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3660 msiexec.exe Token: SeLockMemoryPrivilege 3660 msiexec.exe Token: SeIncreaseQuotaPrivilege 3660 msiexec.exe Token: SeMachineAccountPrivilege 3660 msiexec.exe Token: SeTcbPrivilege 3660 msiexec.exe Token: SeSecurityPrivilege 3660 msiexec.exe Token: SeTakeOwnershipPrivilege 3660 msiexec.exe Token: SeLoadDriverPrivilege 3660 msiexec.exe Token: SeSystemProfilePrivilege 3660 msiexec.exe Token: SeSystemtimePrivilege 3660 msiexec.exe Token: SeProfSingleProcessPrivilege 3660 msiexec.exe Token: SeIncBasePriorityPrivilege 3660 msiexec.exe Token: SeCreatePagefilePrivilege 3660 msiexec.exe Token: SeCreatePermanentPrivilege 3660 msiexec.exe Token: SeBackupPrivilege 3660 msiexec.exe Token: SeRestorePrivilege 3660 msiexec.exe Token: SeShutdownPrivilege 3660 msiexec.exe Token: SeDebugPrivilege 3660 msiexec.exe Token: SeAuditPrivilege 3660 msiexec.exe Token: SeSystemEnvironmentPrivilege 3660 msiexec.exe Token: SeChangeNotifyPrivilege 3660 msiexec.exe Token: SeRemoteShutdownPrivilege 3660 msiexec.exe Token: SeUndockPrivilege 3660 msiexec.exe Token: SeSyncAgentPrivilege 3660 msiexec.exe Token: SeEnableDelegationPrivilege 3660 msiexec.exe Token: SeManageVolumePrivilege 3660 msiexec.exe Token: SeImpersonatePrivilege 3660 msiexec.exe Token: SeCreateGlobalPrivilege 3660 msiexec.exe Token: SeCreateTokenPrivilege 3660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3660 msiexec.exe Token: SeLockMemoryPrivilege 3660 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3660 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 852 wrote to memory of 1576 852 msiexec.exe 93 PID 852 wrote to memory of 1576 852 msiexec.exe 93 PID 852 wrote to memory of 1576 852 msiexec.exe 93
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\HTTP Debugger 9.10\HTTPDebuggerPro.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3F701E64D4BF45F0F28060F499B03942 C2⤵
- Loads dropped DLL
PID:1576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627
-
Filesize
90KB
MD56a9c36332255fca66c688c75aa68e1de
SHA12a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA2567b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SHA512a638c48026f2a0b565b34d7d0dfacfec4f582e698f88234521a6fcff1ed90c134f39aa3311cca2a67e401de01f81cac01d9f792f189127e0f87a345076827627