Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe
-
Size
352KB
-
MD5
4c14197577447b6630c0b90bb394fc90
-
SHA1
e4be5501a73ce292beb39da6dc0774db15d0d666
-
SHA256
b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07
-
SHA512
f914b3244bdd9f12923f6780a7003eba2902cdb16b25e46ec37491c5c81002f75ee6423b3099ed8bebb3ea21ea10aa3cf127dc1e371789e74dd883f0a1415e9d
-
SSDEEP
1536:fiRtp/YdUQt+bNI5fv63ErCYiWA8K2DbXAQKfEiDbgPi7E:fAAdrtp5f3BDT2D8Pi7E
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/1912-0-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 1 IoCs
pid Process 2412 Terms.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\E: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\K: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\O: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\P: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\R: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\S: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\T: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\X: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\Z: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\J: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\Q: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\U: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\V: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\G: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\H: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\I: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\Y: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\L: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\M: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\N: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened (read-only) \??\W: b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Terms.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Terms.exe b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe File opened for modification C:\Program Files (x86)\Terms.exe b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Terms.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-9b-da-77-84-ea Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-9b-da-77-84-ea\WpadDecisionReason = "1" Terms.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Terms.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2}\WpadDecisionReason = "1" Terms.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2}\WpadDecisionTime = 80b9fbd0bf76da01 Terms.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Terms.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Terms.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Terms.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2}\WpadNetworkName = "Network 3" Terms.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-9b-da-77-84-ea\WpadDecisionTime = 80b9fbd0bf76da01 Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-9b-da-77-84-ea\WpadDecision = "0" Terms.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Terms.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Terms.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2} Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2}\WpadDecision = "0" Terms.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F7F5CCB-537B-4B7A-BBE8-FE795D760CD2}\26-9b-da-77-84-ea Terms.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Terms.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Terms.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Terms.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1912 b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe"C:\Users\Admin\AppData\Local\Temp\b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
C:\Program Files (x86)\Terms.exe"C:\Program Files (x86)\Terms.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD54c14197577447b6630c0b90bb394fc90
SHA1e4be5501a73ce292beb39da6dc0774db15d0d666
SHA256b02f1f1b0e58944d00967fc9a93e1ee19d85111ed54ba26a634c77d499635e07
SHA512f914b3244bdd9f12923f6780a7003eba2902cdb16b25e46ec37491c5c81002f75ee6423b3099ed8bebb3ea21ea10aa3cf127dc1e371789e74dd883f0a1415e9d