Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27-01-2024 16:43
Static task
static1
Behavioral task
behavioral1
Sample
HY_Whereisit373702_ljh.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
HY_Whereisit373702_ljh.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
安装说明.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
安装说明.url
Resource
win10v2004-20231215-en
General
-
Target
Setup.exe
-
Size
3.9MB
-
MD5
917f6a260b0022a268317343c7203bb4
-
SHA1
72cfe36ea2164cb8aec735d0e125234052d90499
-
SHA256
90948413d398896ea05fdd9c9665198dba5cb32479fc8c3aba0e19d26d52b9fd
-
SHA512
ac67044fbef066717e1fce73b1609cf996aa46bcb30c3be88ddba9073b2f4eb0d317ae159e993303cfb74b3b70f84dd42cdc00ca31919a639b9724f84edb08ef
-
SSDEEP
98304:edjuQfPR0vptUPdekT4JTPx86mGkrJJ8HBTxa4WxL9TR5:ijBa/CAe4AdJEBTxXWxZR5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1792 is-SNOC0.tmp -
Loads dropped DLL 3 IoCs
pid Process 3064 Setup.exe 1792 is-SNOC0.tmp 1792 is-SNOC0.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1792 is-SNOC0.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28 PID 3064 wrote to memory of 1792 3064 Setup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\is-CJ6TN.tmp\is-SNOC0.tmp"C:\Users\Admin\AppData\Local\Temp\is-CJ6TN.tmp\is-SNOC0.tmp" /SL4 $40016 "C:\Users\Admin\AppData\Local\Temp\Setup.exe" 3902811 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
643KB
MD5036ef63e2f9b138a42d6adb54ec0cd1e
SHA1353db5d438205a726a6d54beb62f9c62638f501d
SHA25671b487f0523f213004766402b22bf86fa0ef9891e940d2a4cb12eba6627e7cc6
SHA51231b8f6e76c8c4f5323f12384c41f6f2b04e58545c121da71e2a4da947a9c0aea9eb05df4f8199cc6dc89bc238577c4e2d5fb4b66e77e1130bc72b6c38f207cc9
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3