Analysis
- max time kernel
139s - max time network
160s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
- submitted
27/06/2024, 15:23
General
- Target 点击此处安装语言包.exe
- Size 10.8MB
- Sample240627-ssramaxeje
- SHA256 af884204ca0845632eb01c3a37a9d5609f2b7065b884500658da60080eaab617
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe"C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exeC:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe 47043E045804540476046B0463047604650469044004650470046504580460046104610474047704670465046A0458044D043104330454043D0472044D04430434045B04610467044704530436043504370443045804330431047E04600461044204550434043204--aa`2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\deepscan\I57P9vIG0_ecCW213G\75zdeFQ06.exe"C:\ProgramData\deepscan\I57P9vIG0_ecCW213G\75zdeFQ06.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
75zdeFQ06.txt
75zdeFQ06.exe
mfc120.dll
msvcp120.dll
msvcr120.dll
yGraphHlp180.dll
yclienti.dll
ygraph180.dll
memory/2500-36-0x0000000010000000-0x0000000010374000-memory.dmp
memory/2500-38-0x0000000002A30000-0x0000000002B17000-memory.dmp
memory/2500-34-0x0000000075100000-0x0000000075101000-memory.dmp
memory/2500-30-0x00000000770A0000-0x00000000770A1000-memory.dmp
memory/2500-21-0x0000000010000000-0x0000000010374000-memory.dmp
memory/2500-28-0x00000000770A0000-0x00000000770A1000-memory.dmp
memory/2500-39-0x00000000004C0000-0x0000000000543000-memory.dmp
memory/2500-27-0x0000000073B40000-0x0000000073BDF000-memory.dmp
memory/2500-24-0x0000000074590000-0x000000007461D000-memory.dmp
memory/2500-41-0x0000000002A30000-0x0000000002B17000-memory.dmp
memory/2500-42-0x0000000074590000-0x000000007461D000-memory.dmp
memory/2500-43-0x0000000073B40000-0x0000000073BDF000-memory.dmp
memory/2500-47-0x0000000004440000-0x000000000452B000-memory.dmp
memory/2500-50-0x0000000004C20000-0x0000000004D95000-memory.dmp
memory/2500-52-0x0000000004220000-0x0000000004431000-memory.dmp
memory/2500-53-0x0000000010000000-0x0000000010374000-memory.dmp