Overview
overview
10Static
static
10155绿色�...��.url
windows7-x64
1155绿色�...��.url
windows10-2004-x64
1Connectify...er.exe
windows7-x64
7Connectify...er.exe
windows10-2004-x64
7$PLUGINSDI...lp.dll
windows7-x64
1$PLUGINSDI...lp.dll
windows10-2004-x64
1$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Conn...wn.exe
windows7-x64
3$TEMP/Conn...wn.exe
windows10-2004-x64
3$TEMP/wifi.dll
windows7-x64
1$TEMP/wifi.dll
windows10-2004-x64
1BuildProps.dll
windows7-x64
1BuildProps.dll
windows10-2004-x64
1ConnUPnP.dll
windows7-x64
1ConnUPnP.dll
windows10-2004-x64
1Connectify.exe
windows7-x64
1Connectify.exe
windows10-2004-x64
6ConnectifyNAT.dll
windows7-x64
1ConnectifyNAT.dll
windows10-2004-x64
1Connectify...es.exe
windows7-x64
1Connectify...es.exe
windows10-2004-x64
1Connectifyd.exe
windows7-x64
1Connectifyd.exe
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 05:25
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
ConnectifyInstaller.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
ConnectifyInstaller.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
$TEMP/ConnectifyShutdown.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$TEMP/ConnectifyShutdown.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$TEMP/wifi.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
$TEMP/wifi.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
BuildProps.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
BuildProps.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
ConnUPnP.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
ConnUPnP.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Connectify.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Connectify.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ConnectifyNAT.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
ConnectifyNAT.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
ConnectifyNetServices.exe
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
ConnectifyNetServices.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Connectifyd.exe
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
Connectifyd.exe
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/SimpleSC.dll
-
Size
59KB
-
MD5
52aaf305fba84b5107c453424df1864e
-
SHA1
9887f4bd7458e1a7724b90256c073492843841a7
-
SHA256
f41f1173b9d367bb6a085ff0b19d1273fc0b7dad32fedbb69b07240cfc9950c8
-
SHA512
9a05e7a2f62956bc46d2257496256606f40e7e78ca6199a80f5945f609e4c049a92c03d7b44d301a854a0bce32ff100ff6aa2b66d4fed649c2d90de95875dced
-
SSDEEP
1536:E/qXv1si+Xsp9MNfPTM+Ov01p4f4fx+QxA:rv1EXZBPkvX4x+Qx
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2728 3728 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1504 wrote to memory of 3728 1504 rundll32.exe rundll32.exe PID 1504 wrote to memory of 3728 1504 rundll32.exe rundll32.exe PID 1504 wrote to memory of 3728 1504 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#12⤵PID:3728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 6203⤵
- Program crash
PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3728 -ip 37281⤵PID:4628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:4020
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3728-0-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB