47db5b872b9054b77acf59430abafa600976c5d8967eda9f8e6d3043314c8c33

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/GooglePinyinDownloader.exe
Size

77KB
MD5

1465ec3df8e8ab31f89fa32bcfaf07da
SHA1

73a36f944fbe18a2b3308e790e1948db8a811ce1
SHA256

e3c8772f34c183545cd6d643e8c1b28aeea0abdfb4ebd02b167363fb31195106
SHA512

911276cbad2f32acd34af6c71e1cbd7c6204a4f0aad93a30fb1104d82469e620de878f292ffc406a8e8f8ce05dfe315e496844e8720b3cd74762163f6d7eb25d
SSDEEP

1536:afppeVwsNT+W7Nv1KDMQ0jwg+rZGjvBtulY3ha:a+XwghQBNIZtulYk

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2316	GooglePinyinInstaller.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	GooglePinyinDownloader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooglePinyinDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooglePinyinInstaller.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30
PID 3068 wrote to memory of 2316	3068	GooglePinyinDownloader.exe	30

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GooglePinyinDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GooglePinyinDownloader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\GPYC996.tmp\GooglePinyinInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\GPYC996.tmp\GooglePinyinInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GPYC996.tmp\GooglePinyinInstaller.exe

Filesize
11.5MB

MD5
50cf3f4ed3126a199d076642a87fba62

SHA1
bdd8692bb9feeb95027f0d8cf7d327c5cafac6a0

SHA256
9208f88499d650854f1c3392d8e5e71e139ef93e99e1013c37753690a78fae2a

SHA512
e5e83fdb1c3ac9e30f008a1490c6d857ed82d3f56a667deb61cdb96e6d53155a345db031b63cf10666b4644b2bcb032c332b8adbf357088cef1e94db4f63e9d7

Download Submit