Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/06/2024, 06:04
General
-
Target
阿里巴巴集团招聘部分JD信息2024_5_Talent.Alibaba-inc.exe
-
Size
13.0MB
-
MD5
2b33a8ca3e3d7fa2f1ae010ef161b148
-
SHA1
61689602270bc6c2590b2ff0639cbad6842d48cf
-
SHA256
3866eb85f05127359769f8f569a93cf63db26c41d30725ba6fc528754b92233f
-
SHA512
3163677a66bcfd672792139b2cc53861bb208f85f19f354410c894e0583523644449cd2fb89cb3841f5fc316173ecf6ae929e91352232efeba9a300db191adbd
-
SSDEEP
49152:kuQAa+joXOeSt0Z7qViOe2Fc+GoCJt25IbiXArylJM5cXTDNVwEVgQj:n0jUpIHrylJMoNzV3
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\阿里巴巴集团招聘部分JD信息2024_5_Talent.Alibaba-inc.exe"C:\Users\Admin\AppData\Local\Temp\阿里巴巴集团招聘部分JD信息2024_5_Talent.Alibaba-inc.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c start C:\Users\Admin\AppData\Local\Temp\阿里巴巴集团招聘部分JD信息2024_5_Talent.Alibaba-inc.xlsx3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\阿里巴巴集团招聘部分JD信息2024_5_Talent.Alibaba-inc.xlsx"4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pythonwc.exe"C:\Users\Admin\AppData\Local\Temp\pythonwc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD50c583614eb8ffb4c8c2d9e9880220f1d
SHA10b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA2566cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
SHA51279bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
-
Filesize
884KB
MD5d8b343b5b8f7d2b8b044f7cdd6228311
SHA11c3cc5eb460ca4c98d431adb0c07a0356748edf5
SHA25603ab7e367ad2131e30283b91e2bd7b162029b7f6ac2041b4a2291f95819a185e
SHA512fc59b9143d7d21b2de969ffcf8acc22c53c80a7cef2d606e70e3a2b331343039b7db810ddd1244cd2c9aa2e4fd500f52a7cf50077ad9958064323513fa4f96f5
-
Filesize
4.3MB
MD5e227f9b2c7851a3adf5bc2464803c731
SHA101dfc6e768cc6be405b8b5ded0ec8fb94070c340
SHA2568c1ac8111df13577cfbc709ed6fa97b6e602ca7ae50b02d9bb3f7a6706e7fc05
SHA512ab6a3cb16bf279bf0294cee2eb6f71bdb22c45b3344aebf3baaa772583821e16e7288d8d8810ba1e4792b0d92c41b199c92ddb30e7b43ab0901158acb75c43cb
-
Filesize
96KB
MD5eec9115f8e5b1e4c825680b013dbe09e
SHA1a286461276ff049caac768000aaa008e30664cd6
SHA2561316319b6b332c4654861f655c6e663a46638c1e222e6d535a22c2f1c5423d35
SHA51221ead461cb3aa93e6f1282f0229838b8df4efb7c0ddd8e4941f9627f0550300f650a40be8aed8b16c6c552099b0996da345a7548040254a533feefb7abc7bc0b
-
Filesize
20KB
MD57a2a55a22408a144e8dce067dce02fa3
SHA19c0930f71905b7f356f93849d98d837ef79e1b43
SHA256d29be6b9f07b8d7ef61756e6c9584e784a8c1f6fe5b59c67fb56b99138077887
SHA51262321727a884a969096b6b4624e65b3e81375b7fea59b995023e6bd8cd1d435b1d5b71f0ccb2c874ad265bf47883e079085cfd89a07293f1660c94310f0572cf
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
13.0MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
16KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB