a8a7e4e27a8136b50fde35628e3a2ad6301bdf3a8c1d880b9a1ee469a41b5381

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 08:37

Target

豆包传世.exe
Size

7.8MB
MD5

bdd8475f7d61e0e040fb4bc0c04be632
SHA1

4d02cd34ddac9f72622bd5f8c482c8123739cc5b
SHA256

56bf06097a4002d570cb291a755231e331e23797889a831da7f4ce7f278d2355
SHA512

cbb5b37e3f641a1a15f1dcde2890989367c46bbad7602cf75fef1c76cea858fd7fe53c79e33e110a3c4d6f0b5c0c2dfd7cb1b42b850873ed1510ea4860e3f51f
SSDEEP

98304:k+D/SiClYHp8fVien4vOFipGQ9nLcDy+fXOIP+POpaagyAZyuaPCtByE6228hAuu:kW/pa+Hno2yPIOAfyuSZE6IARwex

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\myini.ini	豆包传世.exe
File created	C:\Windows\SysWOW64\520cs_xy.htm	豆包传世.exe
File created	C:\Windows\SysWOW64\520cs_ys.html	豆包传世.exe
File opened for modification	C:\Windows\SysWOW64\520cs_xy.htm	豆包传世.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2240	豆包传世.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	豆包传世.exe
2240	豆包传世.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	豆包传世.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	豆包传世.exe
2240	豆包传世.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1268 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2720

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\520cs_ys.html

Filesize
19KB

MD5
a483e496050dbff87f07db4cdc983055

SHA1
616cf5e8115b121e59029bb1fe85f3f09cdd5b9a

SHA256
e8afefd32c5baa8b17fac72159a248c16bceec02b75a20625d3578a11a5ef693

SHA512
ddfb6b8320ac2704ad95ceca3ea1af52076e0cfce52c9b0ea8880fde764b729434c124a01c54e67142932944883e81d9e1f366cb14f8f5e58930cf4c9cf0d980

Download Submit
memory/2240-0-0x0000000009020000-0x000000000A03C000-memory.dmp

Filesize
16.1MB

Download
memory/2240-1-0x0000000009020000-0x000000000A03C000-memory.dmp

Filesize
16.1MB

Download
memory/2240-3-0x0000000009020000-0x000000000A03C000-memory.dmp

Filesize
16.1MB

Download
memory/2240-4-0x0000000077700000-0x0000000077701000-memory.dmp

Filesize
4KB

Download
memory/2240-5-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2240-10-0x0000000009020000-0x000000000A03C000-memory.dmp

Filesize
16.1MB

Download
memory/2240-16-0x0000000003F50000-0x0000000003FCE000-memory.dmp

Filesize
504KB

Download
memory/2240-17-0x0000000003F50000-0x0000000003FCE000-memory.dmp

Filesize
504KB

Download
memory/2240-18-0x0000000009020000-0x000000000A03C000-memory.dmp

Filesize
16.1MB

Download