Analysis
-
max time kernel
141s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 08:05
Behavioral task
behavioral1
Sample
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
1e670827fcd92d3066bb1971bfac9af1
-
SHA1
091f0a7d5b1d123c34fd9275f6192406d600992f
-
SHA256
2bfb9ce960038630e44ffd5439a1be605ca310b9894210ba5f81cd272a2e6d5d
-
SHA512
fef0cd40ee6231f63cc87eb7dbe3f402da0bbd570da6c5adb402ecf2509617f3925c57a4c10af8643321d3f054948bbddcf3d85e4de74b5561810f59fda0eceb
-
SSDEEP
24576:72NyN1Z3jc1VCrulw6ZDKPlrc8a/w0Tkm3NCdBTNsf5jcAkSYqyEmpKI:728NnzcErpEmdY8b0TN3NCLTgpYqg
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2324-0-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral2/memory/2324-1-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/2324-13-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral2/memory/864-355-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral2/memory/864-483-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 864 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\msdt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SndVol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TpmInit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bitsadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\credwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iexpress.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DpiScaling.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\calc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CloudNotifications.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdkey.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\newdev.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontdrvhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\replace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tasklist.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\driverquery.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\efsui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mode.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\charmap.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\expand.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\convert.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dplaysvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\instnm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\appidtel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PkgMgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ktmutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Magnify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MRINFO.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MuiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regsvr32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SecEdit.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdate.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\dotnet.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_6d5c373078d6ebb1\cipher.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.1_none_a9ed911ec30c76c5\mtstocom.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.19041.1_none_c27f721834e813f5\bootsect.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_b970f5eb6342eadb\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..documents.resources_31bf3856ad364e35_10.0.19041.1_en-us_c863490bca720bd6\oobe_learn_more_activity_history.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\memoryAnalyzer.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferrorrenewrentallicense.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSiteEdge.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_71d70fbd497cca66\Windows.Media.BackgroundPlayback.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\f\psr.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\cortana.html ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\r\SecurityHealthService.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\enterpriseNgcEnrollment.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_2aa26221a7a3d549\stordiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\aspnetca.exe ZhuDongFangYu.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\hcsdiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1_none_e9b79397c28488a5\pcalua.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\helloEnrollment.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\pdferrorquitapplicationguard.html ZhuDongFangYu.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmplayer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\f\BdeUISrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\MoUsoCoreWorker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-6.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\VSSVC.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\invalidcert.htm ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\hololensWorkAccount.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvax64.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\SyncAppvPublishingServer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\header.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\pdferrorquitapplicationguard.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\r\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\r\ChtIME.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqbkup.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\wextract.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\pdferror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\oobeenterpriseprovisioning-main.html ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\f\dllhost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_d6be4622df33d026\edpnotify.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.1_none_683b3c51d469e51b\LicenseManagerShellext.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\needie.html ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 2324 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe Token: SeDebugPrivilege 864 ZhuDongFangYu.exe Token: 33 864 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 864 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exeZhuDongFangYu.exepid process 2324 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe 864 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exedescription pid process target process PID 2324 wrote to memory of 864 2324 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe ZhuDongFangYu.exe PID 2324 wrote to memory of 864 2324 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe ZhuDongFangYu.exe PID 2324 wrote to memory of 864 2324 202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\202405201e670827fcd92d3066bb1971bfac9af1icedidxiaobaminer_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:864
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD51e670827fcd92d3066bb1971bfac9af1
SHA1091f0a7d5b1d123c34fd9275f6192406d600992f
SHA2562bfb9ce960038630e44ffd5439a1be605ca310b9894210ba5f81cd272a2e6d5d
SHA512fef0cd40ee6231f63cc87eb7dbe3f402da0bbd570da6c5adb402ecf2509617f3925c57a4c10af8643321d3f054948bbddcf3d85e4de74b5561810f59fda0eceb
-
Filesize
82KB
MD581c35fe848c0383ffea47697999d08b5
SHA1f8fbda7a7e4c1b5c6857cd7bacee2c6ac6e1431d
SHA2564fde901666cd1657b931d5f3e6b28cfc668544c8c7a759bd5729733bb0c79147
SHA512b067b7664a297e11ec94e0776a889d34f47057662a470e7a3d907e7158fa2d0ab476e4dd21c390fadd22efc27be9add81441deddb596e4005e809ca8514ab913