d2cd99f2ffcad6cc11d3798ad269c5a711ac9a9bd445e940df99b65d8b095d4b

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RunDict.exe
Size

361KB
MD5

ad2960fde1e77cb9f59ba8ebde31b73a
SHA1

93bffbd719f2017beece3dcabe2e5a5b093d7844
SHA256

791597b08e6d3f2358ce6ceaab6abc94c030da7ee9b22baf594c58f8d1f6b040
SHA512

00369da06d7e22104821cce62e1398a1625acb8f0d21b28d9b507ba092c8069314a810558c67d9762f0708fae77673e253153c92569acef7a1c30f00a6e7a7ac
SSDEEP

6144:ueoo4DrmbppQbNWDf79h5L0lvfW1NGu/HhQ1UCDICJlhM8:2Dr2ppQMcvfW3DHhQ1J5hM8

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\YodaoDict.api	YodaoDict.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\YodaoDict.api	YodaoDict.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	YodaoDict.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	YodaoDict.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	YodaoDict.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2156	YodaoDict.exe
Token: SeIncBasePriorityPrivilege	2156	YodaoDict.exe
Token: 33	2156	YodaoDict.exe
Token: SeIncBasePriorityPrivilege	2156	YodaoDict.exe
Token: 33	2156	YodaoDict.exe
Token: SeIncBasePriorityPrivilege	2156	YodaoDict.exe
Token: 33	2156	YodaoDict.exe
Token: SeIncBasePriorityPrivilege	2156	YodaoDict.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2936	YoudaoEH.exe
2936	YoudaoEH.exe
2156	YodaoDict.exe
2156	YodaoDict.exe
2156	YodaoDict.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2156	2432	RunDict.exe	30
PID 2432 wrote to memory of 2156	2432	RunDict.exe	30
PID 2432 wrote to memory of 2156	2432	RunDict.exe	30
PID 2432 wrote to memory of 2156	2432	RunDict.exe	30
PID 2156 wrote to memory of 2936	2156	YodaoDict.exe	31
PID 2156 wrote to memory of 2936	2156	YodaoDict.exe	31
PID 2156 wrote to memory of 2936	2156	YodaoDict.exe	31
PID 2156 wrote to memory of 2936	2156	YodaoDict.exe	31

C:\Users\Admin\AppData\Local\Temp\RunDict.exe
"C:\Users\Admin\AppData\Local\Temp\RunDict.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\YodaoDict.exe
  "C:\Users\Admin\AppData\Local\Temp\YodaoDict.exe" start
  2⤵
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\YoudaoEH.exe
    "C:\Users\Admin\AppData\Local\Temp\YoudaoEH.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Youdao\DeskDict\ddupdate\dictupdate.xml

Filesize
5KB

MD5
1aaac195b685939e22902871f0337d26

SHA1
07ac75f91dce9f6743644d5f6036170216b9f26e

SHA256
a5adf51560694560eebe7348b86505f0685adabbf9bb4ebd92bb03280f993e2e

SHA512
31bdcd4b3664a3f177e700333881801e6050a53bce4d97dfd0391bae814e0cbd7869a85b004062bd6c3605c4c00aa676cd54bba705e7620c4cb705ce34e78f29

Download Submit
C:\Users\Admin\AppData\Local\Yodao\DeskDict\cache\index.cab

Filesize
95KB

MD5
783aecd15c6add959e5357c6178514ff

SHA1
46c48ad8c936cf79fabd3d37cc7850f64d6cea38

SHA256
f6fc2e316358f54fec4eb6b52c445792efd2604d68934ef0895499f233325d07

SHA512
3cd650dc3a1765911d7c1f6d28965565d6389fac229109938b6a1e103f31ca9e57599b7d41c93037ed95a29c551c57c6764a8b020ebc503969536c4f35402e3c

Download Submit
C:\Users\Admin\AppData\Local\Yodao\DeskDict\cache\index.cab.md5

Filesize
34B

MD5
d74249e681b2f0ccf7c61d0c5430218a

SHA1
0c4e809998fb149408cb6581967c4d71b8967edd

SHA256
60f36aa79f436fd611e16c7cd8ca928e709712fda22fafccfc79fd8d66569569

SHA512
b34bb8ec066bf443a6ae937f2c7b8170ad9efe3665f823b5c3aab1c470847a23a5cfb1fd07624230d885cf5c2b256bd9b098d8a887cabe51fd6531df50f34858

Download Submit