Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/12/2023, 05:41
General
-
Target
6221新.exe
-
Size
265KB
-
MD5
4372635f940e9263290505d9bfdcbbe4
-
SHA1
0ae3820396a771cb8f37cc95c3834fac7068c790
-
SHA256
c0fef0c9cda8bc2da1f0743f9700dbddd58d342383ad598e2a834b7a6f8ae0e6
-
SHA512
43de006727d7a72e1407416261818d41003ea619c64e053c4898ef53b023a7ce11d2ba9a7b6de7ec100bad1d20c389cb65f503075205f2bb936a6f11f928e5cc
-
SSDEEP
3072:4EbUmOnQUneuV6yez7W8cnRKdkbuCuma2A6dPnP0A8dq8JOpe37VgEoY46LgjNED:4gQea6yez7W3RSkbu1N5sPTPizoh7D
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6221新.exe"C:\Users\Admin\AppData\Local\Temp\6221新.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{C91C370A-70E4-4ec0-9A81-02C37C354A61}.exe"C:\Users\Admin\AppData\Local\Temp\{C91C370A-70E4-4ec0-9A81-02C37C354A61}.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\{E7B69DF1-7F9F-4f0a-B082-F1C17C4C1316}" /f2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thunder.exe"C:\Users\Admin\AppData\Local\Temp\Thunder.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\{E7B69DF1-7F9F-4f0a-B082-F1C17C4C1316}" /f3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Desktop\{5F7323A3-2309-4ddf-8792-938647AE1E0C}.exe"C:\Users\Admin\Desktop\{5F7323A3-2309-4ddf-8792-938647AE1E0C}.exe" "C:\Users\Admin\Desktop\{5F7323A3-2309-4ddf-8792-938647AE1E0C}.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD59d0b3066fe3d1fd345e86bc7bcced9e4
SHA1e05984a6671fcfecbc465e613d72d42bda35fd90
SHA2564e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e
SHA512d773ca3490918e26a42f90f5c75a0728b040e414d03599ca70e99737a339858e9f0c99711bed8eeebd5e763d10d45e19c4e7520ee62d6957bc9799fd62d4e119
-
Filesize
186KB
MD5f76923c7f17614e4f364f800e9a2d090
SHA10d95dbf62c8b903f9ee98719cc8df95aba6c45d5
SHA256c7d45904a5fadebc83dcef3d26fc200d496cda1a4b5f6867e48d106421160828
SHA51277edc466f59af81e14c8a2a1d638211636d8b27ba1edefb84b654ce21ee9413f82c66e4b7d0c17debbc55da3e2366635d2bd24231ae5eb8d71a8b2683e9787cd
-
Filesize
160KB
MD57681eac6c5ebdb7bb8e2d583bfa16341
SHA1b788d9e9090dc153888fb86e823516c8cf871591
SHA256e57ebdf2eb9a5cbb9d405974573d33e63f28c9c1a7ed552d0c4bee1eb8d09a43
SHA512e55a698a85359c8b032996e0b5d5870d2c014dad0d01b71b92c8a73ce5b87289d567731ec2d437f785d71e5ac9675f1a215ec8a5ff8135adb455a4160a05c554
-
Filesize
1024KB
MD592c6763032aa1e11375af275dbd52677
SHA1ca7a28592e68c216be1e4a8fae423de892f2cb13
SHA256a5e6631ed7914f49baf9608cb3091eb8a9214d5ff8d01314fa2b80b634db4270
SHA5123c37dc1835ae930b187f12d1c6436abb2e84b9672a4a2452ee396df17ab7ebd406973e493cb952bbb477063578ba911c6a01223a70e5f1daa02bb0d5fdba0821
-
Filesize
176KB
MD5d339c73539cdaa70c7ff348cb0e4d597
SHA1ef247b10ddf7e29cdab4de08657ff36e2a998a1e
SHA25660b4a4d5dbed67709a4e8d484dcd9099f76eaf27e39c85faa11ecc0a4206b99f
SHA512dd3199cc4180c5ec0f072ca67f89b62337b6ae5d6b7c4d8ebeafbb33d52c8524e6f82e9674592cfd57ff58e22090a07d2569bb8af0e89495024a3a74a088991f
-
Filesize
864B
MD5c8f76501f080962d32a52f7f4bd8b154
SHA1a8429717852263197a13942777eaa8fb6a3ec9a0
SHA2565f99ec9ef90e6c61765d2409b14ea84b59360ff091583378dc10556d4306af5d
SHA512bbe90256cd3e6589d48532e21d3fc576b83043af55cd848c8b094d400790e5b95b34998e61313343de4deb3198060a46f3036f082e643c35db65db9ec11c96e7
-
Filesize
1KB
MD59afd34ffcdefadd644e35a566a55856a
SHA1c107f2095cf6e5aaafc3df7b70059c8b89c48191
SHA256109f06b3c82f7ec80560432acfe05339b6bae3762d95218aa95782e6e11e3516
SHA512adb30d4b5d8e7413f5362c269cd58b8aec2e9aa83a0eed197fd04476ecd8f3c5b826629514a60e24ee127ebdad15ea00f55e19a47e68ab80b26839f447d39e5b
-
Filesize
44KB
MD56bed6dab88b16ed37aa3b4177e9271ed
SHA13f3165eae3aa3490135c34be82ed09e9c4c58c47
SHA25613e9178b2347e5a2865506ade0b566b4877073643921502715dd7b415e2c7510
SHA51276af2b9b7847e089cc13e82928fbddae473a63841de245872c86b664092f164bffe2a9d16ca8997a083696e85c1429dac25cc917a123770adbadffe72b20cb64
-
Filesize
12KB
MD5804a1ff3eb8d495312e05a2ffabb9c4a
SHA121334dfbc4e22b5a38acc06b576b1fef3d5ce705
SHA256c45368e52c237444d4a87ae57d2c70629f4d6aa0d7fe54bfd7331905b5a5f4b2
SHA5121363f2be5f22a7d3a60fb50fed9bdc8e12f39e12af190877a177e888de1ece75c3a8df691c67eb5abf27e14acf0cdf8a3daacf7e8e1f8e8f52a758dca65d38e9
-
Filesize
515KB
MD515290fc8f641fa38e96bd208e70e9654
SHA1fcca666640c53960a779e0ec6594d6d3feae7694
SHA2560967a47a5f1d734dda6abfd53f4f81d70509e360a8ab6a6474f349e8b1352909
SHA5125ee1be332d8a68a331070bc2bae998199995f71ff9b65b07725ae316327cee55214263fa5423fd585cbbd76be885dbf61d0bd4922ec211a63959f889455cec5d
-
Filesize
806KB
MD5b3f9eef2b467793d8b103bf19f557439
SHA125bef6f3022414dcad89cf14dbdfbfb74550267c
SHA25655bf2c6aa048121ca3f0f1797936c56296c3a717babe9fb4a77a2c60bdf6910c
SHA512637905383c7ff5947249cd209b15c38c1b3f0992549a42e6ca2497c8b9ed614bf7bc4d44abc305db968fe38ce9e7a3ec419351e70d0c20811ec39733d34cfcad
-
Filesize
35KB
MD5417c6664ef51618f5b8488aaf3994ce7
SHA122d46528cf43d696d95cf83627887be3de583fcf
SHA256ca84c30bb0ebe9d29fe10b91501b66394287a56c5ee2755472d235095518d70b
SHA512729575838ae5a75dba66eece3df596560bd67279e8c9b83c03198594bf513e442f19384495e3a14f151247020bcf76c6a85e8a255f441bcde858e59fc7db79a3
-
Filesize
21KB
MD5d056f288b27111a15611e2e06418956c
SHA129a361a493de58ab7f8c16e73eacfb7b2a504302
SHA2566f09f9da58d5e8dbbeb940830a8815b6cf962334e2f265643cc871a54604b892
SHA512c964dbe6f9bccca24a78f38d27b2838328ade8b853e7f7d32332f6a692ba689c4ca021f15f7f24bdd06b341a22566142246008e9b45815b0de5f117b10b67073
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
260KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
516KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.6MB
-
Filesize
232KB
-
Filesize
260KB
-
Filesize
1.6MB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
408KB
-
Filesize
388KB
-
Filesize
1.9MB