Overview

overview

8

Static

static

3

73732e5a8b...10.zip

windows7-x64

1

73732e5a8b...10.zip

windows10-2004-x64

1

Edgesetup.exe

windows7-x64

8

Edgesetup.exe

windows10-2004-x64

8

HtmlAgilityPack.dll

windows7-x64

1

HtmlAgilityPack.dll

windows10-2004-x64

1

IWshRuntim...ry.dll

windows7-x64

1

IWshRuntim...ry.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

runtimes/w...er.dll

windows7-x64

3

runtimes/w...er.dll

windows10-2004-x64

3

老虎京�...��.exe

windows7-x64

3

老虎京�...��.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73732e5a8ba1f1039173e2ed4b96184d861762458a947db8a76a0d9f39ebe610

  • Size

    9.3MB

  • Sample

    240814-dmk44azhlk

  • MD5

    00bd1cf56abd0ba4186e09338d87b1ec

  • SHA1

    547c9a6908d4598a22eda623369ec971e0d858c3

  • SHA256

    73732e5a8ba1f1039173e2ed4b96184d861762458a947db8a76a0d9f39ebe610

  • SHA512

    41abeeead94d88dbbd0ef8f3de63b273addd2248550326305267115ab2ebd5dc535ca09f35a7a1116c3b25acf9d9babc28b56eee0ad2107d76d2baf70e8e093f

  • SSDEEP

    196608:LhA+T11fBmJHum0G9f4DuxtNkQv0qVx4nH7YQKJUJstAuKrv:Lq61fBmJH9N96ateQRx4nH7zKJUJstD0

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      73732e5a8ba1f1039173e2ed4b96184d861762458a947db8a76a0d9f39ebe610

    • Size

      9.3MB

    • MD5

      00bd1cf56abd0ba4186e09338d87b1ec

    • SHA1

      547c9a6908d4598a22eda623369ec971e0d858c3

    • SHA256

      73732e5a8ba1f1039173e2ed4b96184d861762458a947db8a76a0d9f39ebe610

    • SHA512

      41abeeead94d88dbbd0ef8f3de63b273addd2248550326305267115ab2ebd5dc535ca09f35a7a1116c3b25acf9d9babc28b56eee0ad2107d76d2baf70e8e093f

    • SSDEEP

      196608:LhA+T11fBmJHum0G9f4DuxtNkQv0qVx4nH7YQKJUJstAuKrv:Lq61fBmJH9N96ateQRx4nH7zKJUJstD0

    Score
    1/10
    behavioral1behavioral2

    • Target

      Edgesetup.exe

    • Size

      1.5MB

    • MD5

      8b3b487e9dfd2852b5c8634b418e7c7e

    • SHA1

      45ff4beb4125aed9fef91e88c03e93b8853ddeb8

    • SHA256

      61ab4d9e17954ad9885736ccd19a9a7e809105074b59d12ab78f4eefbe5d9581

    • SHA512

      2c041aeb5decf51134afbbf5583ed4a23d92ff5a7bcc35450a07f123b9950a57646522a5dcb34089e118ee353ecd1041e0eb020e55f9b9f8e67bb35cf519295d

    • SSDEEP

      24576:3wy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzU:Ay53w24gQu3TPZ2psFkiSqwoz

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      HtmlAgilityPack.dll

    • Size

      115KB

    • MD5

      b851e4a9cf0870f899dbdd9d855c3821

    • SHA1

      9048afea46867dd1f54ab70502b817df82f0b7e7

    • SHA256

      b858e16e8465bd2b3e7f1976056f46be8aad86263624a218ab4df967fd9904ed

    • SHA512

      f4847a8ba0f7ee95fd0d720f6db4720a427f14b904349c5d06ed9638fb9fd9e565c724dc2b40f9f9222a1d0191ba54ff1b51731ece1997592719e780f1ee833b

    • SSDEEP

      1536:4le60pZRv/nabEYBaT8+iCm8aYFlJCBoFpPNo0c5FMUzfjdrlELbbDk1d7KyYpR2:4E9Nyb8T8+iCmklM2pWfD5ddSRBHI

    Score
    1/10
    behavioral5behavioral6

    • Target

      IWshRuntimeLibrary.dll

    • Size

      48KB

    • MD5

      15f58b56385aa3c0021ce7880bcb637f

    • SHA1

      fd7b3e828116b864f68cb3ca7ad79f53142221d1

    • SHA256

      1ce738ec3288f942bdebf00d310f673f6f5a1c6e39bbd207ea3b0b8630cbada9

    • SHA512

      e9752363dc71310f08640269bc20c1b834383a49b55060c9d40cf65a71d2bee8ce416dcb337d2611ef6d58549e6166704515401399b1bd9cc1af749b7c07a59e

    • SSDEEP

      768:wsDuyxtDHHHHHI3HHHHHI1HHHHHI/O6zUyXJRekXrSqdztVq2z9IkCBWWtcNzz:AcErrHSWPq2z9IDWpH

    Score
    1/10
    behavioral7behavioral8

    • Target

      Newtonsoft.Json.dll

    • Size

      501KB

    • MD5

      0188b4b4cb87f44aaacbf2b977a780d3

    • SHA1

      8c3517eb5ef9acfac54d6feaeadd35f4317d548e

    • SHA256

      f359672fff093862bbc619d4413fe46c0a1b2449c21e4078b16d87799cc75eb7

    • SHA512

      0ed5dd563041777e73fdd06bbd33233467d3289e7a4384e7b65e5b9f2c33c4a8df9ff0f7a36e10b32821699f34a2287a6a31f07b5ddd182862b9eb606e108c49

    • SSDEEP

      6144:PQd9z8Uhax4VV+qyipmKAlVQwzT9pdPH+ra4alTBFXKc+9AQupKn:PQ9hvs4w39pdfIadBMAQln

    Score
    1/10
    behavioral10behavioral9

    • Target

      runtimes/win-x86/native/WebView2Loader.dll

    • Size

      113KB

    • MD5

      ddbff8775c62512a791da900b9c88091

    • SHA1

      d85968262ed61ec64333bae3b838356a3544c51a

    • SHA256

      92b7b5c74aca5fdc5a5be4f9a9194de4e63c6780323cebc329aec0896e82238d

    • SHA512

      a0604edf3efede9a940fa999658647347885daaa872457fd3af5afc9e1de8753c73de68c77f9aeacfddff4f39676090d6b4710fa7c81a4d7aa1d60c00d7d590c

    • SSDEEP

      3072:tYh/N1Qh5NZN2fi1LDUFWExc6GCH3QKHy7TrkEtoAl5FMuerl:qhrm5LN2fg83c6rEtlTu9

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      老虎京东助手.exe

    • Size

      9.6MB

    • MD5

      0b9e1df7d7b6b367575a1ee02847fba1

    • SHA1

      90c5ebe5b2b1e9e6cf32bb08d20e06e29bfbb228

    • SHA256

      30cbfb479f34da15d7487eb6c0b03206e3d75e7ddaf0a9bdead2b2495d2bd26a

    • SHA512

      f64523ffe074a9ecad30aa10f134e8d8ecec51478997c6d6994c6263fbcba7c21133b254a4a2c636edb1df8852e2386decb8ec9c15a01df522fdce8c4a3c7146

    • SSDEEP

      196608:elDrcfX0X9sD1JlIyN7y749xXDqYj6A15BaeQvRvtO:eYXQ9a17LNeCxeYVCNv

    Score
    3/10
    discovery
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks