48f0a490c266898b388de042f4d9c57aefe4bff73d4696f0ccbf086f288674bd

Analysis

max time kernel
284s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

阿里金融业务部招聘jd&福利.exe
Size

15.1MB
MD5

c715960ea6fd1df8a623aaafec17d39b
SHA1

3070308b9c5896524d5125065c1455ee6c484953
SHA256

48f0a490c266898b388de042f4d9c57aefe4bff73d4696f0ccbf086f288674bd
SHA512

20012c998779a4cc82a7a6cf9ee6a4dcec3d817ec87e58b0cd861b0d2791b595a174881649da6026f9ca074e951ef7ab046463a515ae413cf9880b143c370df8
SSDEEP

393216:nZV26VPBSC1Z3KoAes59pJznHARSQ3el+HPgmlwrfI:nvSC1ZJvsPzmSQ3el+Igwc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2308	alibaba.com

Loads dropped DLL 1 IoCs

pid	Process
2308	alibaba.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	阿里金融业务部招聘jd&福利.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4612	4436	阿里金融业务部招聘jd&福利.exe	70
PID 4436 wrote to memory of 4612	4436	阿里金融业务部招聘jd&福利.exe	70
PID 4616 wrote to memory of 2308	4616	explorer.exe	72
PID 4616 wrote to memory of 2308	4616	explorer.exe	72

C:\Users\Admin\AppData\Local\Temp\阿里金融业务部招聘jd&福利.exe
"C:\Users\Admin\AppData\Local\Temp\阿里金融业务部招聘jd&福利.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" ".\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\alibaba.com"
  2⤵
  PID:4612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\alibaba.com
  "C:\Users\Admin\AppData\Local\Temp\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\alibaba.com"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\PROPSYS.dll

Filesize
15.4MB

MD5
41e885a1f1aa539562a782c4ab22824a

SHA1
f65c0931d75f78d4dfe98b0915bf6556e106ba9b

SHA256
804871f6424f865800c7b0984c4fb11ce5d1e44c93568f370a7405609177ea63

SHA512
e793b0d13dd00fe2e47863d27a9b05f5aabdcb1eafd384307eaea39d21dca14c9bd42f818740b333b64e851ecb3e440de06d834eccdaeb08e0cf959f3ec3bd33

Download Submit
C:\Users\Admin\AppData\Local\Temp\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\alibaba.com

Filesize
242KB

MD5
d239ed3700f590720b4639cd88478c00

SHA1
0da56dbf37caa0201593d3d2533c3376caa1456a

SHA256
ec8e4a4a211d934595a9ad4aa8112d9decf682f74b08bf45d5aa38ab8fd172f5

SHA512
725c90a0ac8790b29607047809d123b56712d5498034b2cf9c1ad5c30869905a9c181e7e03b7db6e0b4b8bd0504e99b45e40849118f807f7260c461bdd7e6a31

Download Submit
memory/2308-23-0x000001BFEECF0000-0x000001BFEED12000-memory.dmp

Filesize
136KB

Download
memory/2308-17-0x00000000706A0000-0x0000000073E7D000-memory.dmp

Filesize
55.9MB

Download
memory/2308-32-0x000001BFF4680000-0x000001BFF46D8000-memory.dmp

Filesize
352KB

Download
memory/2308-33-0x000001BFF4670000-0x000001BFF4672000-memory.dmp

Filesize
8KB

Download