Analysis
-
max time kernel
124s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/更多软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/更多软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/飘荡软件.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/飘荡软件.url
Resource
win10v2004-20240426-en
General
-
Target
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
-
Size
2.4MB
-
MD5
bea30d48453f1e355a9696450bf5ff9f
-
SHA1
c535c02da7e6a4ea234da574c9d2a89ccdd72539
-
SHA256
54472feb835d6cfc4dfe0f661f904e60185984fb7711c8decef8cb9bd2bde1ae
-
SHA512
e4bfdb440a6a9a962d290ccaab52c8b9083cc7d10097d4e879010c0d0bae7e6fa4968f98f9d3542cdbc3ad6f507b75ad0d94d9150770b8f6cac5c33a4da2da62
-
SSDEEP
24576:0w34ZhrtzT3gkd3o8SxkSkI4z9OIu4d1KCH/CbtmmxUGUuH3GvNcW:0bhzDgkzu/2ruyJHanxUGUuXIX
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
resource yara_rule behavioral2/memory/5048-1-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-4-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-3-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-7-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-9-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-8-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-10-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-11-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-6-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-5-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-17-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-16-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-66-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-65-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5048-67-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-68-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-69-0x0000000002690000-0x000000000371E000-memory.dmp upx behavioral2/memory/5048-108-0x0000000002690000-0x000000000371E000-memory.dmp upx -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened (read-only) \??\I: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\J: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\M: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\N: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\P: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\S: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\H: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\K: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\T: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\V: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\G: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\O: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\U: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\W: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Y: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\E: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\L: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Q: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\R: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\X: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Z: 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification \??\PhysicalDrive0 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification F:\autorun.inf 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\autorun.inf 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops file in Program Files directory 12 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops file in Windows directory 1 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exepid process 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription pid process Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exepid process 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription pid process target process PID 5048 wrote to memory of 780 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 784 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 316 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe dwm.exe PID 5048 wrote to memory of 2592 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe sihost.exe PID 5048 wrote to memory of 2612 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 2988 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhostw.exe PID 5048 wrote to memory of 3488 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 5048 wrote to memory of 3704 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 3900 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 5048 wrote to memory of 3996 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe StartMenuExperienceHost.exe PID 5048 wrote to memory of 4064 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 768 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe SearchApp.exe PID 5048 wrote to memory of 4156 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 2228 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 4712 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe TextInputHost.exe PID 5048 wrote to memory of 3912 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe backgroundTaskHost.exe PID 5048 wrote to memory of 780 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 784 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 316 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe dwm.exe PID 5048 wrote to memory of 2592 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe sihost.exe PID 5048 wrote to memory of 2612 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 2988 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhostw.exe PID 5048 wrote to memory of 3488 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 5048 wrote to memory of 3704 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 3900 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 5048 wrote to memory of 3996 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe StartMenuExperienceHost.exe PID 5048 wrote to memory of 4064 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 768 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe SearchApp.exe PID 5048 wrote to memory of 4156 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 2228 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 4712 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe TextInputHost.exe PID 5048 wrote to memory of 3912 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe backgroundTaskHost.exe PID 5048 wrote to memory of 780 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 784 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 316 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe dwm.exe PID 5048 wrote to memory of 2592 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe sihost.exe PID 5048 wrote to memory of 2612 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 2988 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhostw.exe PID 5048 wrote to memory of 3488 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 5048 wrote to memory of 3704 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 3900 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 5048 wrote to memory of 3996 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe StartMenuExperienceHost.exe PID 5048 wrote to memory of 4064 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 768 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe SearchApp.exe PID 5048 wrote to memory of 4156 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 2228 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 4712 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe TextInputHost.exe PID 5048 wrote to memory of 3912 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe backgroundTaskHost.exe PID 5048 wrote to memory of 780 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 784 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe fontdrvhost.exe PID 5048 wrote to memory of 316 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe dwm.exe PID 5048 wrote to memory of 2592 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe sihost.exe PID 5048 wrote to memory of 2612 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 2988 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhostw.exe PID 5048 wrote to memory of 3488 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 5048 wrote to memory of 3704 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe svchost.exe PID 5048 wrote to memory of 3900 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 5048 wrote to memory of 3996 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe StartMenuExperienceHost.exe PID 5048 wrote to memory of 4064 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 768 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe SearchApp.exe PID 5048 wrote to memory of 4156 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 2228 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe RuntimeBroker.exe PID 5048 wrote to memory of 4712 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe TextInputHost.exe PID 5048 wrote to memory of 3912 5048 小笨鸟万能论坛自动顶帖机软件1.3.exe backgroundTaskHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\小笨鸟万能论坛自动顶帖机软件 1.3破解版\小笨鸟万能论坛自动顶帖机软件1.3.exe"C:\Users\Admin\AppData\Local\Temp\小笨鸟万能论坛自动顶帖机软件 1.3破解版\小笨鸟万能论坛自动顶帖机软件1.3.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\rapsj.exeFilesize
100KB
MD5909be77f5784061dab4c6a2e221b83c6
SHA1effdf26035ec5702c49f4347b8cb27ecda7db7bc
SHA25609786f260dcaa29076b5f7efad2bfd37850b7fcc5fa9f1cde7da0e09898731d7
SHA51240f4dc1dc4e426315724432ac7f0a6d7f690e9ad56407f704cf921651b7c57b3364aaca9d52f9466377cf0c8d638e6a11cff6c3ab25c06ee0eec9acef51fdec7
-
memory/5048-0-0x0000000000400000-0x00000000006A9000-memory.dmpFilesize
2.7MB
-
memory/5048-1-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-4-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-3-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-7-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-9-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-8-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-10-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-11-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-13-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/5048-14-0x0000000004890000-0x0000000004892000-memory.dmpFilesize
8KB
-
memory/5048-12-0x0000000004890000-0x0000000004892000-memory.dmpFilesize
8KB
-
memory/5048-6-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-5-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-15-0x0000000004890000-0x0000000004892000-memory.dmpFilesize
8KB
-
memory/5048-17-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-16-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-50-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-64-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-66-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-62-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-60-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-56-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-54-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-52-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-46-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-40-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-38-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-36-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-34-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-32-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-30-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-28-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-24-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-21-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5048-67-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-68-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-69-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-108-0x0000000002690000-0x000000000371E000-memory.dmpFilesize
16.6MB
-
memory/5048-115-0x0000000004890000-0x0000000004892000-memory.dmpFilesize
8KB