Analysis
-
max time kernel
76s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46b0827fe24cdffd156cba6ac744f715.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
46b0827fe24cdffd156cba6ac744f715.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
46b0827fe24cdffd156cba6ac744f715.exe
-
Size
80KB
-
MD5
46b0827fe24cdffd156cba6ac744f715
-
SHA1
b521e71b35d0b7ff04d997159af92ff383185240
-
SHA256
1ad9ff1770f7dd8378dc5d266d1a6a13ebae97c25299cd482b3ff2b445e1bcba
-
SHA512
18852c145e07c8c8d265e23adfa5104ab00f4ee80dfd105e43539450fb2dfc9268abb22babfff74112a375cde9a2ad30a0177ba716ed0b85bd1e41626e247edd
-
SSDEEP
1536:Y9tq/zeQNgbzXj4vFW3Jhqmroig2j2CWQN9XAAiwCUxQ/e3:+260iXjX1rBjGUxQ/e3
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Beep.sys 46b0827fe24cdffd156cba6ac744f715.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys 46b0827fe24cdffd156cba6ac744f715.exe -
Deletes itself 1 IoCs
pid Process 1992 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1696 SiZhu.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 46b0827fe24cdffd156cba6ac744f715.exe File opened (read-only) \??\H: 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1696 set thread context of 2736 1696 SiZhu.exe 31 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SiZhu.exe 46b0827fe24cdffd156cba6ac744f715.exe File created C:\Windows\SiZhu.exe 46b0827fe24cdffd156cba6ac744f715.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\SoftWare\Microsoft\Internet Explorer\Main 46b0827fe24cdffd156cba6ac744f715.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mirengeqian.cn/" 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe 2672 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 468 Process not Found 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 2672 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2672 wrote to memory of 1696 2672 46b0827fe24cdffd156cba6ac744f715.exe 30 PID 2672 wrote to memory of 1696 2672 46b0827fe24cdffd156cba6ac744f715.exe 30 PID 2672 wrote to memory of 1696 2672 46b0827fe24cdffd156cba6ac744f715.exe 30 PID 2672 wrote to memory of 1696 2672 46b0827fe24cdffd156cba6ac744f715.exe 30 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 1696 wrote to memory of 2736 1696 SiZhu.exe 31 PID 2672 wrote to memory of 1992 2672 46b0827fe24cdffd156cba6ac744f715.exe 33 PID 2672 wrote to memory of 1992 2672 46b0827fe24cdffd156cba6ac744f715.exe 33 PID 2672 wrote to memory of 1992 2672 46b0827fe24cdffd156cba6ac744f715.exe 33 PID 2672 wrote to memory of 1992 2672 46b0827fe24cdffd156cba6ac744f715.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b0827fe24cdffd156cba6ac744f715.exe"C:\Users\Admin\AppData\Local\Temp\46b0827fe24cdffd156cba6ac744f715.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SiZhu.exeC:\Windows\SiZhu.exe SiZhu2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2736
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat2⤵
- Deletes itself
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5a1d17e8addd410a3eccee0a345d15c7b
SHA1ba42521d0cc05b08e796b7b422c0bfe4a6a5e454
SHA256e367e27ae99a478fb403c80bc7d8ab700cc3095480635d953e013d05cd5d1cf0
SHA512defdf018ac8bed0dd3bdcaf880d5f8ed07381a4921f9112bb8745d053c77610474883323f15c46a8294c9a2b18fa445be35f44a1d56ac98bfbcfc023f7aa696c
-
Filesize
80KB
MD546b0827fe24cdffd156cba6ac744f715
SHA1b521e71b35d0b7ff04d997159af92ff383185240
SHA2561ad9ff1770f7dd8378dc5d266d1a6a13ebae97c25299cd482b3ff2b445e1bcba
SHA51218852c145e07c8c8d265e23adfa5104ab00f4ee80dfd105e43539450fb2dfc9268abb22babfff74112a375cde9a2ad30a0177ba716ed0b85bd1e41626e247edd