Overview
overview
10Static
static
3Win11�...VC.url
windows7-x64
1Win11�...VC.url
windows10-2004-x64
1Win11�...��.url
windows7-x64
1Win11�...��.url
windows10-2004-x64
1Win11�...��.exe
windows7-x64
1Win11�...��.exe
windows10-2004-x64
1Win11�...WD.bat
windows7-x64
10Win11�...WD.bat
windows10-2004-x64
10Win11�...WD.bat
windows7-x64
10Win11�...WD.bat
windows10-2004-x64
10Win11�...do.exe
windows7-x64
1Win11�...do.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Win11 1.06/#XIAOYI.VC.url
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Win11 1.06/#XIAOYI.VC.url
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Win11 1.06/#ע.url
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Win11 1.06/#ע.url
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
Win11 1.06/Windows11.exe
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
Win11 1.06/Windows11.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
Win11 1.06/data/DisableWD.bat
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
Win11 1.06/data/DisableWD.bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
Win11 1.06/data/EnableWD.bat
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Win11 1.06/data/EnableWD.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
Win11 1.06/data/MinSudo.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Win11 1.06/data/MinSudo.exe
Resource
win10v2004-20231023-en
General
-
Target
d5f303961cbba2ebcebaac5b0c716814c313d69e1d9a44ab2d05f581c542ba1c
-
Size
437KB
-
MD5
8673969c09b8d978e1b4560b69495381
-
SHA1
50cbf3513e83ba8a3e7d87855f1642ba40fc2335
-
SHA256
d5f303961cbba2ebcebaac5b0c716814c313d69e1d9a44ab2d05f581c542ba1c
-
SHA512
091485caa05cbf444c15ad627cc0404cb1cfa206e00bbf4edf248031944c208d98d0349989b70937d3ac4999f1dea592982a2f4782cb3cb397727a7ecfadfb7d
-
SSDEEP
12288:THQ1gKigLTy4WVvn9pc7HbZ0cpHFoFxzoy:z8gKrq4WRn9pcHmIHKB
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Win11 1.06/Windows11.exe unpack001/Win11 1.06/data/MinSudo.exe
Files
-
d5f303961cbba2ebcebaac5b0c716814c313d69e1d9a44ab2d05f581c542ba1c.zip
-
Win11 1.06/#XIAOYI.VC.url.url
-
Win11 1.06/#ע.url.url
-
Win11 1.06/#ȡ.png.png
-
Win11 1.06/#ǵȺ.txt
-
Win11 1.06/Windows11.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 351KB - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Win11 1.06/data/DisableWD.bat
-
Win11 1.06/data/EnableWD.bat
-
Win11 1.06/data/MinSudo.exe.exe windows:6 windows x64 arch:x64
67388bde455ae6efd14658691bba0416
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetThreadUILanguage
WaitForSingleObjectEx
LockResource
CloseHandle
FreeConsole
FindResourceExW
LoadResource
AttachConsole
GetCurrentDirectoryW
WriteConsoleW
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
SleepEx
GetTickCount
GetLastError
MultiByteToWideChar
OpenProcess
SetThreadUILanguage
GetModuleFileNameW
WriteFile
GetStdHandle
GetConsoleOutputCP
GetCurrentProcess
GetCommandLineW
SetLastError
HeapFree
SetConsoleCtrlHandler
HeapAlloc
SizeofResource
GetModuleHandleExW
FreeLibrary
ExitProcess
Sleep
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
SetTokenInformation
IsWellKnownSid
OpenProcessToken
SetThreadToken
StartServiceW
CreateProcessAsUserW
OpenServiceW
DuplicateTokenEx
QueryServiceStatusEx
GetTokenInformation
shell32
ShellExecuteExW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
msvcrt
_environ
__argc
__argv
?_set_new_mode@@YAHH@Z
_commode
_msize
__getmainargs
realloc
free
malloc
_callnewh
_wcsnicmp
_wcsicmp
_amsg_exit
memset
__C_specific_handler
_CxxThrowException
strstr
wcsstr
__CxxFrameHandler3
__set_app_type
_XcptFilter
?terminate@@YAXXZ
_errno
strcpy_s
_initterm_e
_set_fmode
_initterm
memcpy
memcmp
memmove
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Win11 1.06/data/readme.txt
-
Win11 1.06/data/smartscreen/disable.reg
-
Win11 1.06/data/smartscreen/restore.reg