d3c4ef6c545055f0e205bfe4cbc8dbddccb0d5ecdad4033530c50a2be967121c

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

多功能修改器综合版v1.1——小伟.exe
Size

505KB
MD5

024ea367fafb50fde5427dbeaa9ec9a4
SHA1

923623854ac441e0a95062eb8367347c356e7d7a
SHA256

2d2cc4c7f3e544b4644bd737248f4e99b254e7ba23fb036cde328bbdd8e701b6
SHA512

e1f2cc28f7ce6e616f2759c81527484be6dd8e9fbfdca9699f336639a0a222e9a2ee55b5400bbf46088a3e44c1c17d34a9a6b7044a8b1dc4e2868823441a88e7
SSDEEP

12288:EuZAol+fhSzXW6dfAVJ9/O2nWGNOQ0sDJZMSuDoSF:LZAoUJSzXdOVJ82TNaKO1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral11/memory/2168-0-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral11/memory/2168-51-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-52-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-53-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-54-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-55-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-56-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-57-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-58-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-59-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-60-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-61-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-62-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-63-0x0000000000400000-0x00000000005B0000-memory.dmp	upx
behavioral11/memory/2168-64-0x0000000000400000-0x00000000005B0000-memory.dmp	upx

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kq1018824590"	多功能修改器综合版v1.1——小伟.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.2345.com/?kq1018824590"	多功能修改器综合版v1.1——小伟.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2168	多功能修改器综合版v1.1——小伟.exe
Token: SeIncBasePriorityPrivilege	2168	多功能修改器综合版v1.1——小伟.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	多功能修改器综合版v1.1——小伟.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2168	多功能修改器综合版v1.1——小伟.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2168	多功能修改器综合版v1.1——小伟.exe
2168	多功能修改器综合版v1.1——小伟.exe
2168	多功能修改器综合版v1.1——小伟.exe
2168	多功能修改器综合版v1.1——小伟.exe
2168	多功能修改器综合版v1.1——小伟.exe

C:\Users\Admin\AppData\Local\Temp\多功能修改器综合版v1.1——小伟.exe
"C:\Users\Admin\AppData\Local\Temp\多功能修改器综合版v1.1——小伟.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2168-51-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-52-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-53-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-54-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-55-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-56-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-57-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-58-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-59-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-60-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-61-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-62-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-63-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2168-64-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download