Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 10:42
Behavioral task
behavioral1
Sample
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe
Resource
win7-20240221-en
General
-
Target
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe
-
Size
5.1MB
-
MD5
72f2b49a64a3b9243478af5313774ba4
-
SHA1
6f8786f22afaa92882b08c9443c06785c062a7b4
-
SHA256
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06
-
SHA512
04ba1e457504d7e996a21887380e0244c889aef8ba1ab2ee13d57a2fae5c76daecd64dc5a9c66229e2de13831ad36fd0834c26a66fa7f8f35ac189092ef444e7
-
SSDEEP
49152:7bCknzcErNNQJLxgjI45TMwwapIgThpYqB+Cq99LyHHI+t6O8N+ailEy6dmpzeiU:SXPLapIK6J0oAaldmdmnp
Malware Config
Signatures
-
Detect Blackmoon payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1564-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/1564-11-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/3692-15-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/3692-354-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/3692-485-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 3692 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\autochk.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\printui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\instnm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\powercfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RdpSa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskkill.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\find.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\NETSTAT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PING.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hdwwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icsunattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasdial.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msdt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\replace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\userinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wlanext.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tracerpt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tttracer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dccw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpupdate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicli.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net1.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tcmsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscadminui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Com\comrepl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\esentutl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\help.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\logman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\verclsid.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\user.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tree.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpapimig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\grpconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runonce.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\typeperf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OpenWith.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\appidtel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bootcfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\comp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhst3g.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mspaint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscript.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe ZhuDongFangYu.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\gpscript.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-4.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\reset.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.1_none_22d9ddcd4b2b9d68\CameraSettingsUIHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\printui.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\servbusy.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpconfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\rasautou.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_2fe41983d5cad0a7\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\view\common-header-template.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\repost.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\DisableAboutFlag.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\f\CIDiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\CheckNetIsolation.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-footer-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\f\PktMon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\fixmapi.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\401.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\http_406.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.1_none_e73c658ee671e530\ChtIME.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_ee5c058bea34543e\f\WmiPrvSE.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\common-header-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-4.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\r\CustomShellHost.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\wdagtool.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\PnPUnattend.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\provtool.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFaultSecure.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\r\smartscreen.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\user.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVNice.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_5dccefa0bb5ef60b\clip.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\MoUsoCoreWorker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\ScreenClipping\ScreenClippingHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.19041.1_none_827105fe900187d1\wiawow64.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.844_none_5308232e9343b869\f\WinBioDataModelOOBE.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorrepurchasecontent.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\default.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\oobeautopilotreboot-main.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\f\directxdatabaseupdater.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\r\dnscacheugc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-keygen.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\console.html ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\Utilman.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\needie.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrorrenewrentallicense.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-2.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.1_none_7c69077ba55f962b\WSReset.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 1564 ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe Token: SeDebugPrivilege 3692 ZhuDongFangYu.exe Token: 33 3692 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 3692 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exeZhuDongFangYu.exepid process 1564 ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe 3692 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exedescription pid process target process PID 1564 wrote to memory of 3692 1564 ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe ZhuDongFangYu.exe PID 1564 wrote to memory of 3692 1564 ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe ZhuDongFangYu.exe PID 1564 wrote to memory of 3692 1564 ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe"C:\Users\Admin\AppData\Local\Temp\ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
5.1MB
MD572f2b49a64a3b9243478af5313774ba4
SHA16f8786f22afaa92882b08c9443c06785c062a7b4
SHA256ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06
SHA51204ba1e457504d7e996a21887380e0244c889aef8ba1ab2ee13d57a2fae5c76daecd64dc5a9c66229e2de13831ad36fd0834c26a66fa7f8f35ac189092ef444e7
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD5a18050232832c1a9d3161464641df3f0
SHA1dfeda4c93b2b9dd9690ac707b62380a1396ff8ed
SHA25630200fdee84a11ef50fb75c72de83ca69656a5ffb0d3d23fee31192753d560fa
SHA512ed969c940b6354f2c574ed91724a9f6f93131f4b0444d70366d860c3f237d3d3f5fd266aa308c6efaf458831988351088f80f64a0b74bbfac07da79389c5bfa3
-
memory/1564-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1564-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1564-11-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3692-15-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3692-354-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3692-485-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB