Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 11:54
Behavioral task
behavioral1
Sample
Baidukongjianrenqiwang.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Baidukongjianrenqiwang.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Baidukongjianrenqiwang.exe
-
Size
1.3MB
-
MD5
a08c45488228c75a96d9b3c100481b25
-
SHA1
a1ea78b322598a51e5ae4f72bccdf19c12789560
-
SHA256
1d6a1d75a9e3293547d6976da5dc07bdd9c529b50635221e02433ffda9ccbb0b
-
SHA512
83577d8bd3f07d41c0e4a825bb28aedf4b76fbcc13924341b9df9e571a071348584178b091bd86d8e88e1c423aa15bcb07f06139a33ac5e141c89d5ed32dee19
-
SSDEEP
24576:V7uuFdWw/VMXG5OPVi0oIKKEJDaXteZpMXfln/j6mNM9KKk9dXLk:Nuuz+XGoPVu3KEdz4vN+Kf3
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4536 SeMiniSetup_silent_3170_1032.exe -
resource yara_rule behavioral2/memory/4920-0-0x0000000051000000-0x0000000051341000-memory.dmp upx behavioral2/memory/4920-1-0x0000000051000000-0x0000000051341000-memory.dmp upx behavioral2/memory/4920-356-0x0000000051000000-0x0000000051341000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 SeMiniSetup_silent_3170_1032.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4920 Baidukongjianrenqiwang.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4920 Baidukongjianrenqiwang.exe 4920 Baidukongjianrenqiwang.exe 4920 Baidukongjianrenqiwang.exe 4536 SeMiniSetup_silent_3170_1032.exe 4536 SeMiniSetup_silent_3170_1032.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4536 4920 Baidukongjianrenqiwang.exe 85 PID 4920 wrote to memory of 4536 4920 Baidukongjianrenqiwang.exe 85 PID 4920 wrote to memory of 4536 4920 Baidukongjianrenqiwang.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Baidukongjianrenqiwang.exe"C:\Users\Admin\AppData\Local\Temp\Baidukongjianrenqiwang.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\SeMiniSetup_silent_3170_1032.exec:\SeMiniSetup_silent_3170_1032.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD57eca282e3eae667721e6561abc1bca9f
SHA1cd8c56da648d3a0332bb52ac4a80dc34083b4878
SHA256cffd8ee1978e4a5b60e8eb70291df1ccf3e92317fb22d3ff24b73688b108a1f3
SHA5128f70e86177fb4fe56288ec90f50f8c3b728ce9eb33127c80a2dcaaa863c3cd2ba22746c91ecd8a03023512939a97bd3ecc2b56674d87324611e50a5ed55d3e98
-
Filesize
145KB
MD5e0eb8ba5c8a5aea01cc8556459b00075
SHA17ed39205f63d720ee547d265bcbefcaf75305707
SHA256008a0609d9caa187e81d86f7b76881f7e92227da579ff38c689d175aa66eb0b9
SHA5122d54f71219f81f258f2bb4f94f1869a1045e2dee90e39dbcae22e8a8d602d10eb0de7400249350e47dfb3978ed5a5743502fef13d898991dbc77f7c05f4df0ea