Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 07:50
Behavioral task
behavioral1
Sample
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe
Resource
win7-20240508-en
General
-
Target
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe
-
Size
8.7MB
-
MD5
7f4bc96edae762d503ef08cbda95f186
-
SHA1
cbf40546f9a8e07c897d43440848420c2f827eba
-
SHA256
7102a8566234210ea623311461f402e7e6d48af95dbd64864ed6ae079eefe0f2
-
SHA512
c239534daedc006eecab65f1b2874482f85db4c0e61de75965c37c9a19dadbbcfe13aa58e4390eedf1888617d0b170d1785448a7379a9b1219a51ca08884e98d
-
SSDEEP
98304:3bg8cCY6J0oAaldmdmnpq63WQtZ/K0tGOFWVRuLftCT:ZY6OKmd0E63WyZ/K0ttYVAAT
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2056-0-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral1/memory/2056-5-0x0000000002AF0000-0x0000000002B45000-memory.dmp family_blackmoon behavioral1/memory/2056-8-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2188-375-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2188-761-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 2188 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exepid process 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\w32tm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autofmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\choice.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ftp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ieUnatt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\recover.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autochk.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\calc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icsunattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\instnm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ssText3d.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mspaint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rundll32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ktmutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\MigSetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icardagt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SecEdit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\credwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tree.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\getmac.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RegisterIEPKEYs.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SndVol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sxstrace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mode.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\compact.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ipconfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mcbuilder.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\write.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Bubbles.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Magnify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wimserv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpnsvr.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html ZhuDongFangYu.exe File created C:\Program Files\Windows Defender\MSASCui.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\tracerpt.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-3.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\RSSFeeds.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_80543131e5508a75\TsWpfWrp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-10.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_843823d87402ab36\tasklist.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_39b468a7491888f2\calendar.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-18.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_c33f455aebcd9dbb\bthudtask.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7601.17514_none_4f18faed6aae2509\bitsadmin.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_29b7ce69634b90ae\RSSFeeds.html ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_8.0.7601.17514_none_1e7b93842c84c912\ConfigureIEOptionalComponents.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7601.17514_none_7b380cb06fd9d81d\SBEServer.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2d7749943fcc6ea3\currency.html ZhuDongFangYu.exe File created C:\Windows\hh.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_ba9e94bf275d71ed\Dism.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\settings.html ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgradeui_31bf3856ad364e35_6.1.7600.16385_none_4aadf3be188c056d\WindowsAnytimeUpgradeui.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\printui.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-18.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_cf7705f47fa8cd65\AtBroker.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_9d906433a20c1949\RpcPing.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-14.htm ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\WinMail.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_8d8925a444607f8c\reg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalSansSerif.CompositeFont ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Orange Circles.htm ZhuDongFangYu.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\FreeCell.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmc.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7601.17514_none_e501f8e06b32b48f\net1.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.exe_7eb73dcd ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1f85c65eb05726c7\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_964da911ba806d45\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_52db65a773b633fd\ComSvcConfig.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchFilterHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_59e6a839753b16d1\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-13.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Garden.htm ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_6.1.7600.16385_none_4c045ec8fda52d34\fveprompt.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-3.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_b0de2afe4ca7a1e2\DeviceDisplayObjectProvider.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_b1186146f739d0f1\forfiles.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\plasrv.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PATHPING.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fd3784c9b57cdcbf\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-8.htm ZhuDongFangYu.exe File created C:\Windows\twunk_16.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe Token: SeDebugPrivilege 2188 ZhuDongFangYu.exe Token: 33 2188 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2188 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe 2188 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exedescription pid process target process PID 2056 wrote to memory of 2188 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2056 wrote to memory of 2188 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2056 wrote to memory of 2188 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2056 wrote to memory of 2188 2056 2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_7f4bc96edae762d503ef08cbda95f186_icedid_xiaobaminer.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2188
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
Filesize16KB
MD517f3bbed916ce900652433f2593ff684
SHA185d4fbf534aa8acd759a489d31e06ac27677f3a7
SHA256aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
SHA51281a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
Filesize6KB
MD524bed74a2a49536d75ebfd9c87d105eb
SHA1ec830db2834d33dd61437ccf330ca2ad6b73e377
SHA2563cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
SHA512a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize12KB
MD533f73419b8fc156a8a5e0eee311a2639
SHA17ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA5121f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize8KB
MD5ffbe89b376301d5a5e1602502f3a049e
SHA14fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA51225807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize14KB
MD5138687bae4d5ae5ecd9f49d4603846b6
SHA1b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
SHA256aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
SHA512c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize16KB
MD5b8723baac78bf9c17d116fe9b25c81b2
SHA17b04a048a42f9611afde747a57694574de887783
SHA256b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
SHA5121293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e
-
Filesize
82KB
MD55ada3219de669cea5578c4d802060870
SHA1510095f27695adaf19ad1db75483c6f06ca3247b
SHA2565a4c3b7070bf46e8b7b6f29c5e26d80d66542b8e9439845a8575decb033673b1
SHA512379d0c6ac03366bcd335363d7b0d976bfb763f4412e23951391d0ca8d4b571af71049ea98855f9a05e65383629c8f7292a8c876959d142c8eec0e39345ab3abd
-
Filesize
8.7MB
MD57f4bc96edae762d503ef08cbda95f186
SHA1cbf40546f9a8e07c897d43440848420c2f827eba
SHA2567102a8566234210ea623311461f402e7e6d48af95dbd64864ed6ae079eefe0f2
SHA512c239534daedc006eecab65f1b2874482f85db4c0e61de75965c37c9a19dadbbcfe13aa58e4390eedf1888617d0b170d1785448a7379a9b1219a51ca08884e98d