Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 14:16
Static task
static1
Behavioral task
behavioral1
Sample
ebc2ca06581e4454135ec3edf7bb6a60N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ebc2ca06581e4454135ec3edf7bb6a60N.exe
Resource
win10v2004-20240709-en
General
-
Target
ebc2ca06581e4454135ec3edf7bb6a60N.exe
-
Size
45KB
-
MD5
ebc2ca06581e4454135ec3edf7bb6a60
-
SHA1
913e88724d8ac5127df1b43fcb3ce6bc0f59c2c1
-
SHA256
cfaba85ba50fe0fbdc66bf1b2d6050bf7e33f1cdfe1c9bc263a379e0c15957e7
-
SHA512
43e2caa79f1d5690cc61fddd91f0744a4e100931cd856d6761ac79f9201981742e7b67f4e723d9cece207098158efa0465902366e3d5ea0b6b000fbcfad9d68c
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUx:8h7xsCKosi5pzjIcdRiTpqMGxs3B
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ebc2ca06581e4454135ec3edf7bb6a60N.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsimport.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mip.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javah.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javapackager.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\unpack200.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\serialver.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jinfo.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\keytool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\servertool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\policytool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\servertool.exe ebc2ca06581e4454135ec3edf7bb6a60N.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ebc2ca06581e4454135ec3edf7bb6a60N.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ebc2ca06581e4454135ec3edf7bb6a60N.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ebc2ca06581e4454135ec3edf7bb6a60N.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ebc2ca06581e4454135ec3edf7bb6a60N.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3140 wrote to memory of 1392 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 84 PID 3140 wrote to memory of 1392 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 84 PID 3140 wrote to memory of 1392 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 84 PID 3140 wrote to memory of 2984 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 88 PID 3140 wrote to memory of 2984 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 88 PID 3140 wrote to memory of 2984 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 88 PID 3140 wrote to memory of 4424 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 89 PID 3140 wrote to memory of 4424 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 89 PID 3140 wrote to memory of 4424 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 89 PID 3140 wrote to memory of 4744 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 90 PID 3140 wrote to memory of 4744 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 90 PID 3140 wrote to memory of 4744 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 90 PID 3140 wrote to memory of 2300 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 91 PID 3140 wrote to memory of 2300 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 91 PID 3140 wrote to memory of 2300 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 91 PID 3140 wrote to memory of 4732 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 92 PID 3140 wrote to memory of 4732 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 92 PID 3140 wrote to memory of 4732 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 92 PID 3140 wrote to memory of 4120 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 93 PID 3140 wrote to memory of 4120 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 93 PID 3140 wrote to memory of 4120 3140 ebc2ca06581e4454135ec3edf7bb6a60N.exe 93 PID 2984 wrote to memory of 1876 2984 cmd.exe 100 PID 2984 wrote to memory of 1876 2984 cmd.exe 100 PID 2984 wrote to memory of 1876 2984 cmd.exe 100 PID 2984 wrote to memory of 4664 2984 cmd.exe 101 PID 2984 wrote to memory of 4664 2984 cmd.exe 101 PID 2984 wrote to memory of 4664 2984 cmd.exe 101 PID 2984 wrote to memory of 2252 2984 cmd.exe 102 PID 2984 wrote to memory of 2252 2984 cmd.exe 102 PID 2984 wrote to memory of 2252 2984 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe"C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:1876
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4664
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2252
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:4424
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4744
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe2⤵
- Modifies registry class
PID:2300
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe2⤵
- Modifies registry class
PID:4732
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\ebc2ca06581e4454135ec3edf7bb6a60N.exe2⤵
- Modifies registry class
PID:4120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD53f2a70f15a959308b912701ac928e3e7
SHA18ac88c291a88c8ac37a6b00f793875145167a0d5
SHA256e70dae20c5a2ea37b97ca2b440d97a48c3132f990de696b4e5b740b2c801d9a3
SHA512b7716c57a3e98b7e05ccce5d57e36a1a57fe25c8cb107d2b020f2b4273ae5cfd799ae218337e034c6c15883f7e09db0f2bbb27db3a512a9b82368698bd9004ed