Analysis
- max time kernel
103s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 05:07
Behavioral task
behavioral1
Sample
578aa83192207de9ab6e27e2029eb000N.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
578aa83192207de9ab6e27e2029eb000N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
120 seconds
General
- Target 578aa83192207de9ab6e27e2029eb000N.exe
- Size 50KB
- Sample240719-fsd9vaxejh
- SHA256 925f0ffa395a1d6f90541471ed85dd771e84c49fc64f735b2c3a885653c7cea4
- MD5 578aa83192207de9ab6e27e2029eb000
- SHA1 ef74ba737372b6fcf53fde24f09d0d83d57464eb
- SHA512 a6443512a850c3af0468ec15db5aa179930d0121e473251978f58c97b6ac11dcaa13a9bbe9c920354227f4da2abd85352c2f07f18e7595aa0142d5d1bb4a15f9
- SSDEEP 1536:p7xsCKosi5pzjIcdRiTpj2+dnouy8wxsjVUx:8hWbcpj2+loutDU
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\578aa83192207de9ab6e27e2029eb000N.exe " cmd.exe -
resource yara_rule behavioral2/memory/2524-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x00030000000229c4-7.dat upx behavioral2/memory/2524-1016-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javah.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jar.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\klist.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jps.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jcmd.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\pack200.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstack.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstat.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javapackager.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\extcheck.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\xjc.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 578aa83192207de9ab6e27e2029eb000N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 578aa83192207de9ab6e27e2029eb000N.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\578aa83192207de9ab6e27e2029eb000N.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\578aa83192207de9ab6e27e2029eb000N.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\578aa83192207de9ab6e27e2029eb000N.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\578aa83192207de9ab6e27e2029eb000N.exe " cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 578aa83192207de9ab6e27e2029eb000N.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2524 578aa83192207de9ab6e27e2029eb000N.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1508 2524 578aa83192207de9ab6e27e2029eb000N.exe 84 PID 2524 wrote to memory of 1508 2524 578aa83192207de9ab6e27e2029eb000N.exe 84 PID 2524 wrote to memory of 1508 2524 578aa83192207de9ab6e27e2029eb000N.exe 84 PID 2524 wrote to memory of 1840 2524 578aa83192207de9ab6e27e2029eb000N.exe 89 PID 2524 wrote to memory of 1840 2524 578aa83192207de9ab6e27e2029eb000N.exe 89 PID 2524 wrote to memory of 1840 2524 578aa83192207de9ab6e27e2029eb000N.exe 89 PID 2524 wrote to memory of 3276 2524 578aa83192207de9ab6e27e2029eb000N.exe 90 PID 2524 wrote to memory of 3276 2524 578aa83192207de9ab6e27e2029eb000N.exe 90 PID 2524 wrote to memory of 3276 2524 578aa83192207de9ab6e27e2029eb000N.exe 90 PID 2524 wrote to memory of 4732 2524 578aa83192207de9ab6e27e2029eb000N.exe 91 PID 2524 wrote to memory of 4732 2524 578aa83192207de9ab6e27e2029eb000N.exe 91 PID 2524 wrote to memory of 4732 2524 578aa83192207de9ab6e27e2029eb000N.exe 91 PID 2524 wrote to memory of 2904 2524 578aa83192207de9ab6e27e2029eb000N.exe 92 PID 2524 wrote to memory of 2904 2524 578aa83192207de9ab6e27e2029eb000N.exe 92 PID 2524 wrote to memory of 2904 2524 578aa83192207de9ab6e27e2029eb000N.exe 92 PID 2524 wrote to memory of 5016 2524 578aa83192207de9ab6e27e2029eb000N.exe 93 PID 2524 wrote to memory of 5016 2524 578aa83192207de9ab6e27e2029eb000N.exe 93 PID 2524 wrote to memory of 5016 2524 578aa83192207de9ab6e27e2029eb000N.exe 93 PID 2524 wrote to memory of 4840 2524 578aa83192207de9ab6e27e2029eb000N.exe 94 PID 2524 wrote to memory of 4840 2524 578aa83192207de9ab6e27e2029eb000N.exe 94 PID 2524 wrote to memory of 4840 2524 578aa83192207de9ab6e27e2029eb000N.exe 94 PID 1840 wrote to memory of 4468 1840 cmd.exe 101 PID 1840 wrote to memory of 4468 1840 cmd.exe 101 PID 1840 wrote to memory of 4468 1840 cmd.exe 101 PID 1840 wrote to memory of 3092 1840 cmd.exe 102 PID 1840 wrote to memory of 3092 1840 cmd.exe 102 PID 1840 wrote to memory of 3092 1840 cmd.exe 102 PID 1840 wrote to memory of 2316 1840 cmd.exe 103 PID 1840 wrote to memory of 2316 1840 cmd.exe 103 PID 1840 wrote to memory of 2316 1840 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe"C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1508
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4468
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:3092
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2316
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:3276
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4732
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe2⤵
- Modifies registry class
PID:2904
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe2⤵
- Modifies registry class
PID:5016
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\578aa83192207de9ab6e27e2029eb000N.exe2⤵
- Modifies registry class
PID:4840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\123.bat
- Size 443B
- SHA256 d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
- MD5 70170ba16a737a438223b88279dc6c85
- SHA1 cc066efa0fca9bc9f44013660dea6b28ddfd6a24
- SHA512 37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
- MD5 SHA1 SHA512
- Path C:\Program Files\7-Zip\7zG.exe
- Size 50KB
- SHA256 0d8df8f23fd1ebdce7d6fc64fb3d72c528bfcdd7efd98951f764e2654ab09d99
- MD5 5dea690b72bca593fb16dacd3f1ad3b9
- SHA1 17027ca3ba4b802cd6dd4fb560058f25494f0949
- SHA512 515978dff2b7754ba663be3671ad8093b1aff67578f663842e400fdfbb199d8f6560baa30e8b94ffac4c5f9d41ca7cdc675ac9af978d4ac7b2c6523e06a725b6
- SSDEEP 1536:p7xsCKosi5pzjIcdRiTpj2+dnouy8wxsjVU/:8hWbcpj2+loutDa
- MD5 SHA1 SHA512 SSDEEP