Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46b0827fe24cdffd156cba6ac744f715.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
46b0827fe24cdffd156cba6ac744f715.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
46b0827fe24cdffd156cba6ac744f715.exe
-
Size
80KB
-
MD5
46b0827fe24cdffd156cba6ac744f715
-
SHA1
b521e71b35d0b7ff04d997159af92ff383185240
-
SHA256
1ad9ff1770f7dd8378dc5d266d1a6a13ebae97c25299cd482b3ff2b445e1bcba
-
SHA512
18852c145e07c8c8d265e23adfa5104ab00f4ee80dfd105e43539450fb2dfc9268abb22babfff74112a375cde9a2ad30a0177ba716ed0b85bd1e41626e247edd
-
SSDEEP
1536:Y9tq/zeQNgbzXj4vFW3Jhqmroig2j2CWQN9XAAiwCUxQ/e3:+260iXjX1rBjGUxQ/e3
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Beep.sys 46b0827fe24cdffd156cba6ac744f715.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys 46b0827fe24cdffd156cba6ac744f715.exe -
Executes dropped EXE 1 IoCs
pid Process 3840 SiZhu.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 46b0827fe24cdffd156cba6ac744f715.exe File opened (read-only) \??\H: 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3840 set thread context of 1524 3840 SiZhu.exe 94 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SiZhu.exe 46b0827fe24cdffd156cba6ac744f715.exe File created C:\Windows\SiZhu.exe 46b0827fe24cdffd156cba6ac744f715.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3164 1524 WerFault.exe 94 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SoftWare\Microsoft\Internet Explorer\Main 46b0827fe24cdffd156cba6ac744f715.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mirengeqian.cn/" 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe 1996 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe Token: SeDebugPrivilege 1996 46b0827fe24cdffd156cba6ac744f715.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1996 wrote to memory of 3840 1996 46b0827fe24cdffd156cba6ac744f715.exe 93 PID 1996 wrote to memory of 3840 1996 46b0827fe24cdffd156cba6ac744f715.exe 93 PID 1996 wrote to memory of 3840 1996 46b0827fe24cdffd156cba6ac744f715.exe 93 PID 3840 wrote to memory of 1524 3840 SiZhu.exe 94 PID 3840 wrote to memory of 1524 3840 SiZhu.exe 94 PID 3840 wrote to memory of 1524 3840 SiZhu.exe 94 PID 3840 wrote to memory of 1524 3840 SiZhu.exe 94 PID 3840 wrote to memory of 1524 3840 SiZhu.exe 94 PID 1996 wrote to memory of 4868 1996 46b0827fe24cdffd156cba6ac744f715.exe 96 PID 1996 wrote to memory of 4868 1996 46b0827fe24cdffd156cba6ac744f715.exe 96 PID 1996 wrote to memory of 4868 1996 46b0827fe24cdffd156cba6ac744f715.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b0827fe24cdffd156cba6ac744f715.exe"C:\Users\Admin\AppData\Local\Temp\46b0827fe24cdffd156cba6ac744f715.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SiZhu.exeC:\Windows\SiZhu.exe SiZhu2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 124⤵
- Program crash
PID:3164
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat2⤵PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1524 -ip 15241⤵PID:4080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5a1d17e8addd410a3eccee0a345d15c7b
SHA1ba42521d0cc05b08e796b7b422c0bfe4a6a5e454
SHA256e367e27ae99a478fb403c80bc7d8ab700cc3095480635d953e013d05cd5d1cf0
SHA512defdf018ac8bed0dd3bdcaf880d5f8ed07381a4921f9112bb8745d053c77610474883323f15c46a8294c9a2b18fa445be35f44a1d56ac98bfbcfc023f7aa696c
-
Filesize
80KB
MD546b0827fe24cdffd156cba6ac744f715
SHA1b521e71b35d0b7ff04d997159af92ff383185240
SHA2561ad9ff1770f7dd8378dc5d266d1a6a13ebae97c25299cd482b3ff2b445e1bcba
SHA51218852c145e07c8c8d265e23adfa5104ab00f4ee80dfd105e43539450fb2dfc9268abb22babfff74112a375cde9a2ad30a0177ba716ed0b85bd1e41626e247edd