6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da

Analysis

max time kernel
150s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 80KB
Sample240528-appnhsgf72
SHA256 fbe0dfcd053290c88edb9404ef78a8c890a6cfea499c5e596e22c492478a1228
MD5 9d8e49512087b973cb3f889043384915
SHA1 07d2b7661e9fcbfd7dbaa247b3ecd24ed613e8c7
SHA512 e939d5f552ccc5b613c403de46e72c5e59f4e8516c5e7b533320f9a39623bdd4861ba1bbf2a744c6da9dc13107e2ef901170478084b93a6c4876698a09515a1a
SSDEEP 1536:eiy8YBr321Er76ZUiCGDh2GWv6NJg59A4fkl6CxthIcYK2kpzKXJTC+hbeD:eiy8mDt76eGDKyNO55kljx2JXNC+Bc
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2160	iTunes_64_11.3.1.2.exe

Loads dropped DLL 8 IoCs

pid	Process
3024	Tongbu.exe
1068	Process not Found
1264	MsiExec.exe
1264	MsiExec.exe
1264	MsiExec.exe
1264	MsiExec.exe
1264	MsiExec.exe
1264	MsiExec.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral31/memory/2932-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral31/memory/2932-63-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\同步助手移动服务 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tbMobileService.exe /start"	Helper.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
26	2592	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	Tongbu.exe
File opened (read-only)	\??\M:	Tongbu.exe
File opened (read-only)	\??\R:	Tongbu.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	Tongbu.exe
File opened (read-only)	\??\S:	Tongbu.exe
File opened (read-only)	\??\Y:	Tongbu.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	Tongbu.exe
File opened (read-only)	\??\Q:	Tongbu.exe
File opened (read-only)	\??\Z:	Tongbu.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	Tongbu.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	Tongbu.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	Tongbu.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	Tongbu.exe
File opened (read-only)	\??\U:	Tongbu.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	Tongbu.exe
File opened (read-only)	\??\W:	Tongbu.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	Tongbu.exe
File opened (read-only)	\??\P:	Tongbu.exe
File opened (read-only)	\??\T:	Tongbu.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	Tongbu.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	Tongbu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	Tongbu.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\shell\open\command	Helper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipa\OpenWithProgids\iTunes.ipa	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\IPAPackage_File	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tongbu.exe"	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\shell	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tongbu.exe \"%1\""	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipa\ = "iTunes.ipa"	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\CurVer	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\CurVer\ = "iTunes.ipa"	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\DefaultIcon	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipa	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipa\OpenWithProgids	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\DefaultIcon	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\ = "IPAPackage_File"	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tongbu.exe \"%1\""	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PkgInstaller.exe"	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\shell\open	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\IPAPackage_File\command	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\ = "URL:Tongbu URL Protocol"	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\URL Protocol	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\ = "URL:tbtui URL Protocol"	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\URL Protocol	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\shell\open	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\IPAPackage_File\ = "使用同步助手安装(&I)"	PkgInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.ipa\shell\IPAPackage_File\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PkgInstaller.exe\" /open \"%1\""	PkgInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\DefaultIcon	Helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tongbu.exe"	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tongbu\shell	Helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tbtui\shell\open\command	Helper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1420	Helper.exe
108	Helper.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
1264	MsiExec.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe
3024	Tongbu.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	Tongbu.exe
Token: SeDebugPrivilege	2348	PkgInstaller.exe
Token: SeDebugPrivilege	1420	Helper.exe
Token: SeRestorePrivilege	2348	PkgInstaller.exe
Token: SeBackupPrivilege	2348	PkgInstaller.exe
Token: SeDebugPrivilege	1780	tbMobileService.exe
Token: SeDebugPrivilege	108	Helper.exe
Token: 33	3024	Tongbu.exe
Token: SeIncBasePriorityPrivilege	3024	Tongbu.exe
Token: 33	2160	iTunes_64_11.3.1.2.exe
Token: SeIncBasePriorityPrivilege	2160	iTunes_64_11.3.1.2.exe
Token: SeShutdownPrivilege	2592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2592	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeSecurityPrivilege	2932	msiexec.exe
Token: SeCreateTokenPrivilege	2592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2592	msiexec.exe
Token: SeLockMemoryPrivilege	2592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2592	msiexec.exe
Token: SeMachineAccountPrivilege	2592	msiexec.exe
Token: SeTcbPrivilege	2592	msiexec.exe
Token: SeSecurityPrivilege	2592	msiexec.exe
Token: SeTakeOwnershipPrivilege	2592	msiexec.exe
Token: SeLoadDriverPrivilege	2592	msiexec.exe
Token: SeSystemProfilePrivilege	2592	msiexec.exe
Token: SeSystemtimePrivilege	2592	msiexec.exe
Token: SeProfSingleProcessPrivilege	2592	msiexec.exe
Token: SeIncBasePriorityPrivilege	2592	msiexec.exe
Token: SeCreatePagefilePrivilege	2592	msiexec.exe
Token: SeCreatePermanentPrivilege	2592	msiexec.exe
Token: SeBackupPrivilege	2592	msiexec.exe
Token: SeRestorePrivilege	2592	msiexec.exe
Token: SeShutdownPrivilege	2592	msiexec.exe
Token: SeDebugPrivilege	2592	msiexec.exe
Token: SeAuditPrivilege	2592	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2592	msiexec.exe
Token: SeChangeNotifyPrivilege	2592	msiexec.exe
Token: SeRemoteShutdownPrivilege	2592	msiexec.exe
Token: SeUndockPrivilege	2592	msiexec.exe
Token: SeSyncAgentPrivilege	2592	msiexec.exe
Token: SeEnableDelegationPrivilege	2592	msiexec.exe
Token: SeManageVolumePrivilege	2592	msiexec.exe
Token: SeImpersonatePrivilege	2592	msiexec.exe
Token: SeCreateGlobalPrivilege	2592	msiexec.exe
Token: SeCreateTokenPrivilege	2592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2592	msiexec.exe
Token: SeLockMemoryPrivilege	2592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2592	msiexec.exe
Token: SeMachineAccountPrivilege	2592	msiexec.exe
Token: SeTcbPrivilege	2592	msiexec.exe
Token: SeSecurityPrivilege	2592	msiexec.exe
Token: SeTakeOwnershipPrivilege	2592	msiexec.exe
Token: SeLoadDriverPrivilege	2592	msiexec.exe
Token: SeSystemProfilePrivilege	2592	msiexec.exe
Token: SeSystemtimePrivilege	2592	msiexec.exe
Token: SeProfSingleProcessPrivilege	2592	msiexec.exe
Token: SeIncBasePriorityPrivilege	2592	msiexec.exe
Token: SeCreatePagefilePrivilege	2592	msiexec.exe
Token: SeCreatePermanentPrivilege	2592	msiexec.exe
Token: SeBackupPrivilege	2592	msiexec.exe
Token: SeRestorePrivilege	2592	msiexec.exe
Token: SeShutdownPrivilege	2592	msiexec.exe
Token: SeDebugPrivilege	2592	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3024	Tongbu.exe
2592	msiexec.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3024	Tongbu.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2932	Launcher.exe
3024	Tongbu.exe
3024	Tongbu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 2932 wrote to memory of 3024	2932	Launcher.exe	28
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 2348	3024	Tongbu.exe	29
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 3024 wrote to memory of 1420	3024	Tongbu.exe	30
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 2564	1420	Helper.exe	32
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 1420 wrote to memory of 1780	1420	Helper.exe	33
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 108	3024	Tongbu.exe	35
PID 3024 wrote to memory of 2160	3024	Tongbu.exe	37
PID 3024 wrote to memory of 2160	3024	Tongbu.exe	37
PID 3024 wrote to memory of 2160	3024	Tongbu.exe	37
PID 3024 wrote to memory of 2160	3024	Tongbu.exe	37
PID 2160 wrote to memory of 2592	2160	iTunes_64_11.3.1.2.exe	38
PID 2160 wrote to memory of 2592	2160	iTunes_64_11.3.1.2.exe	38
PID 2160 wrote to memory of 2592	2160	iTunes_64_11.3.1.2.exe	38
PID 2160 wrote to memory of 2592	2160	iTunes_64_11.3.1.2.exe	38
PID 2160 wrote to memory of 2592	2160	iTunes_64_11.3.1.2.exe	38
PID 2932 wrote to memory of 1264	2932	msiexec.exe	40
PID 2932 wrote to memory of 1264	2932	msiexec.exe	40
PID 2932 wrote to memory of 1264	2932	msiexec.exe	40
PID 2932 wrote to memory of 1264	2932	msiexec.exe	40
PID 2932 wrote to memory of 1264	2932	msiexec.exe	40
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41
PID 3024 wrote to memory of 2344	3024	Tongbu.exe	41

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\Tongbu.exe
  "C:\Users\Admin\AppData\Local\Temp\Tongbu.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\PkgInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\PkgInstaller.exe" /r
    3⤵
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\Helper.exe" /r
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s "C:\Users\Admin\AppData\Local\Temp\Addin\tbIEAddin.dll
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\tbMobileService.exe
      "C:\Users\Admin\AppData\Local\Temp\tbMobileService.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\Users\Admin\AppData\Local\Temp\Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\Helper.exe" "/update" "/silent" "C:\Users\Admin\AppData\Local\Temp\Tongbu.exe" "Tongbu Assistant" "http://server.tongbu.com/update/otherupdate.aspx?v=2.3.2.2&type=tbzs20" "http://t.tongbu.com/tbzs20/ZSUpdateLog.aspx" "0"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- - C:\Tongbu\PublicStaging\iTunes_64_11.3.1.2.exe
    "C:\Tongbu\PublicStaging\iTunes_64_11.3.1.2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP464.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
      4⤵
      Blocklisted process makes network request
      Enumerates connected drives
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2592
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" -s "C:\Users\Admin\AppData\Local\Temp\Addin\tbIEAddin.dll
    3⤵
    PID:2344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 5653519F5EB14D1CD9DC713324C2F8BB C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ServerSettings.ini.tmp

Path C:\Tongbu\ServerSettings.ini.tmp
Size 9KB
SHA256 e0ca6a1075c0299b24ed5b8ca2331062408696ee4da7e67f52e530f24c1e23ab
MD5 9e8db8c5aebc7d34792611ade90de4d6
SHA1 4773f5208d524120045fb6c5eee1252e3e38fcd6
SHA512 1086901baf28cda40e7c0f97191dfe6f2b79d88d1fe3ac12b73522302730535424b5ef7e0572bb0902b56953725ef3b65a9a775237745efda3c0070835f7fff7
SSDEEP 96:gIb9tu62dcNe5xpb89vpQ9Ddx4pfhkrcoDqibHILnFXfcRbIOqR6r1flhN+mneZu:b9tucWxpo9vpQ9DdQhaanFvwgorVlcu
MD5 SHA1 SHA512 SSDEEP

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_99DDCE8596ED1EF95BA4A048C2A560A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_99DDCE8596ED1EF95BA4A048C2A560A6
Size 1KB
SHA256 29abd90cccc109734016b2698f9e3ba48eeb11d374004ca0b87ce092fb63176b
MD5 201ed4d738f9003b47a867a9fcf94745
SHA1 03c4eca628cd5a22b8539dda032a21d4a01b5445
SHA512 4efa67a6d7ce75ccfd5a9c1696e1304353202a69eb700787efe91cc2eb4816a0f7ec193f3d3c813790ed5f8253408f0a1071e272c1f95a5bce9f4a65ff7e3326
MD5 SHA1 SHA512

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4
MD5 cbed24fd2b55aea95367efca5ee889de
SHA1 946f48b5c344fd57113845cd483fed5fb9fa3e54
SHA512 c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_99DDCE8596ED1EF95BA4A048C2A560A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_99DDCE8596ED1EF95BA4A048C2A560A6
Size 408B
SHA256 b3d466cd47ebd02d671bd5d9af65dcd390b5d109ffd49d01acf4a512fe35c64d
MD5 3b7cf4a1ce488d104e0c6d992cca34c7
SHA1 241e3ab6ddb33690e71847beb47d380c55865bb0
SHA512 ffe81ade2bb87cae4a7a678fcbb6f7ee3729ec1c3608b0f5f5f3d48ff1d1fcc33cca9d2c64c657d86712136e5edf6ca71220cdbf30ed58a082709e06e5ae0601
MD5 SHA1 SHA512

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 12188ac9c6426f60d12256fd42db7971dd812ead770db802ccb3ce5903ff72f5
MD5 bbe8bb8037f4893b2298457b0080cd15
SHA1 383d5d46d20112970526e5da7391a97adb7794f3
SHA512 feb186c42af9b2d48e4ae3ea822a1bbe1da815e7a8bba41a7122b91b8667c052ac967ce894cd4daa92d48309dd1c4c5c814580cf524045afcd5890391726458f
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 966125b1e345d28fa57bcfb043bb327ad6646a12c9064708aa48ee9b25cb7a93
MD5 5b9e4ed3041baf4ef46888d8ca870347
SHA1 e998dab4e717eb1ae52a0897540e427deb086274
SHA512 6c314246b18e72dcb402c202670dc32183e84fc4d2b71c55702797a88d0641a74b210232fd66c10d6da23c34dc61d2b0afc44d1a8722081f4bf057142fa85169
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 e173dfd9d54f3749a6017f962120423e0f9ef3b217ec3231eb409ff7275ffec4
MD5 363c7bf407b5488d6b34e8cad5d7a669
SHA1 cccf4795eea27148945463006beba61eb14e93cc
SHA512 e29c67ea2d33fc263d6c41e3385d1fa5dce39395a7b2844de7a6762ba82db79f6e2e2bcea3cb329af6f9ad246a97b3cd3e06d2ab36ad878b9e7e10bd9c6ac7b6
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 096e655bcae83be5761d0a5dd6eb97cffc4d22a141884e184bcae45100dd2115
MD5 5c91fcdaf660264baf6276c4771edb09
SHA1 773dd26b89ed9a4589ba20fcd28474aae31f25f4
SHA512 a76c7d93399db6e7d5feb6924659b9d725108514a34bb6e190301c440e503dbdfe90389d5a16feb8b6563627dfdd239f9df5b2b8c2087de736ec4dbd45f95de8
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 6271f205194db0f7986d51cccfef0b63f32bd6084a0555869838a295cf6a782a
MD5 d28ec82cbc793053dbfdbd35841d7658
SHA1 ede32b30e4316b43012d8c044c19c4cb7bebb525
SHA512 a23e3dcca3fce16befe0b175227c2789db0a5c10c5995596333a6ea827c6dea7850d77ae54d4fc1e7d36d5a5858eccd1bee0a1b479fbdccc0eda90958295baa2
MD5 SHA1 SHA512

Submit Download

SetupAdmin.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP464.TMP\SetupAdmin.exe
Size 75KB
SHA256 ef1dfdbc66c6f623e8a398f64bd63db2776023908cb387774480f8e8ce65dbca
MD5 30a4b7eb1e0b01d3d358079be43348cc
SHA1 ae59e73ab0d053f52ac6e60ae72dc98e0dcf2910
SHA512 871d2989646b9832912b80054c1bce11c649f3cafc7c00f83f625c272807c5afc1545230b6bcccad5eaaed994246592241ccf06f27ccbce89222b5f86e560d6c
SSDEEP 1536:rvthYCeIrpRJAKwv6qVLtstBkii7wB5GMH4Q:rkAZAKQVL+X9B5bHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar2AFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2AFE.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Settings.ini

Path C:\Users\Admin\Documents\Tongbu\Settings.ini
Size 35B
SHA256 14087c2d47e408b1230152f79c1767af4929fb3b299108e641c03903283b987a
MD5 e726e5334525cddf8559a9c0bbbd6b0e
SHA1 960956fff9bad3abd5fd16bd3ed519d3323d6218
SHA512 f5974a84f7f5bbb20e9a8c9ae69d8a8fea4a0e696347d0d4000691eb884bc5c8978e541a8e7e43fcefd16b94c55fb85a8440388ebc6988750d133f7268340dc7
MD5 SHA1 SHA512

Submit Download

MSI75BE.tmp

Path \Users\Admin\AppData\Local\Temp\MSI75BE.tmp
Size 105KB
SHA256 5a66a3ed6e661597bfa83cc737ba2ebb1dbfd9a368923a668f996f631b0b751e
MD5 90693aa35dcc041e627712e75a1e9e99
SHA1 b99cdf61a523aa86bada730623309d883f6df5cc
SHA512 cc1c46dcb9aa07a91bd8e94ae126c534b508e334650c8941933be5e9670bc0a12179d65e039e5b5d3400e7d3677ed099a3265ae05597edd141134106e0813e5b
SSDEEP 1536:f7ibYBJpB1f09FiIGIX+tl+T2zTj7cpGoMkUQc78DsQdY7NisxQeT44:zkYBHB5SFi/I89H4G+UGsQdYxzT44
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2932-63-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2932-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3024-156-0x000000000F8D0000-0x000000000F8D2000-memory.dmp

Download

memory/3024-2-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download

memory/3024-1-0x00000000739B1000-0x00000000739B2000-memory.dmp

Download

memory/3024-116-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download

memory/3024-66-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download

memory/3024-259-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download

memory/3024-260-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download

memory/3024-262-0x0000000013A30000-0x0000000013BA5000-memory.dmp

Download

memory/3024-271-0x00000000739B0000-0x0000000073F5B000-memory.dmp

Download