e8e776f90b54a4e14b13e5d2fc77eee8c87e2324056fcd6c94ce73dadb652b4c

General

Target

1a67f881624db6efa36d334d1ca9d664.exe
Size

935KB
MD5

1a67f881624db6efa36d334d1ca9d664
SHA1

0251e69ddd75388aabb8e01afcd411bcdc927315
SHA256

e8e776f90b54a4e14b13e5d2fc77eee8c87e2324056fcd6c94ce73dadb652b4c
SHA512

dd9d51a6b9bbf244d311b64f8fabafa19e952e3f19979d02a820b5c4be9f7f2b37110eab24efb08f71b0dca40e9de11cedde3e28833134c5e784d1c010ea4446
SSDEEP

24576:nwlBrygOW3dlJ+2JNk+2JN6iSQALZXjgd:m5dlJnkneQAljgd

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\腾讯QQ.exe	1a67f881624db6efa36d334d1ca9d664.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\腾讯QQ.exe	1a67f881624db6efa36d334d1ca9d664.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000400000-0x000000000049B000-memory.dmp	upx
behavioral2/files/0x000a000000023154-5.dat	upx
behavioral2/files/0x000b000000023154-13.dat	upx
behavioral2/memory/3444-14-0x0000000000400000-0x000000000049B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\拼音输入法 = "C:\\WINDOWS\\Web\\sougou.exe"	1a67f881624db6efa36d334d1ca9d664.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3444-14-0x0000000000400000-0x000000000049B000-memory.dmp	autoit_exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Web\sougou.exe	1a67f881624db6efa36d334d1ca9d664.exe
File created	C:\WINDOWS\Web\sougou.exe	1a67f881624db6efa36d334d1ca9d664.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\main	1a67f881624db6efa36d334d1ca9d664.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.114880.com/?336"	1a67f881624db6efa36d334d1ca9d664.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node	1a67f881624db6efa36d334d1ca9d664.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID	1a67f881624db6efa36d334d1ca9d664.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	1a67f881624db6efa36d334d1ca9d664.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	1a67f881624db6efa36d334d1ca9d664.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	1a67f881624db6efa36d334d1ca9d664.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\""	1a67f881624db6efa36d334d1ca9d664.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\""	1a67f881624db6efa36d334d1ca9d664.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	1a67f881624db6efa36d334d1ca9d664.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4872	PING.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3444	1a67f881624db6efa36d334d1ca9d664.exe
3444	1a67f881624db6efa36d334d1ca9d664.exe
3444	1a67f881624db6efa36d334d1ca9d664.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3444	1a67f881624db6efa36d334d1ca9d664.exe
3444	1a67f881624db6efa36d334d1ca9d664.exe
3444	1a67f881624db6efa36d334d1ca9d664.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1816	3444	1a67f881624db6efa36d334d1ca9d664.exe	91
PID 3444 wrote to memory of 1816	3444	1a67f881624db6efa36d334d1ca9d664.exe	91
PID 3444 wrote to memory of 1816	3444	1a67f881624db6efa36d334d1ca9d664.exe	91
PID 1816 wrote to memory of 4872	1816	cmd.exe	93
PID 1816 wrote to memory of 4872	1816	cmd.exe	93
PID 1816 wrote to memory of 4872	1816	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\1a67f881624db6efa36d334d1ca9d664.exe
"C:\Users\Admin\AppData\Local\Temp\1a67f881624db6efa36d334d1ca9d664.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 3&del/q/s "C:\Users\Admin\AppData\Local\Temp\1a67f881624db6efa36d334d1ca9d664.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut7B89.tmp

Filesize
232KB

MD5
41b30cfdb2918256f424b6cfc31fb585

SHA1
1d71d4de4f25a1ff5e6079f0038706a67b3327d8

SHA256
bd8302b22262e366ab788fc22110ca225d08d0caeda87b468879d5b72a535df6

SHA512
82fe0eb69ae11cd8caf3aac80f0bf5d861a62e3bf58d88bf8374950f295c86bba429a6d9562c21ffa77fe108568adc75e292236b0ef48e580cc5f7a1b1aa5c4f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\腾讯QQ.exe

Filesize
467KB

MD5
2ac3c6f8a2b853a31d1639f24ea37497

SHA1
60b289a18d1717bdb9e7e133b4d451395c56d796

SHA256
aca260d5fa5529699a188d5449435e8a8bfb93e084ef4e56107df2122b205c5c

SHA512
cb74b3bbdbf258d07fe730be2a53828373e6691c2d68b2cf9e8e46c44a482a75c60ac67953e0069e0c02a0fe92521466b51da5243c74a202875cb243616a058e

Download Submit
memory/3444-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3444-14-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads