Overview
overview
7Static
static
7July.chm
windows7-x64
1July.chm
windows10-2004-x64
1July.exe
windows7-x64
7July.exe
windows10-2004-x64
7SysScan.dll
windows7-x64
7SysScan.dll
windows10-2004-x64
7plugins/May.dll
windows7-x64
7plugins/May.dll
windows10-2004-x64
7新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2024 23:40
Behavioral task
behavioral1
Sample
July.chm
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
July.chm
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
July.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
July.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SysScan.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
SysScan.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
plugins/May.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
plugins/May.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
新云软件.url
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
新云软件.url
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
July.exe
-
Size
73KB
-
MD5
74d0bdefeaae305d2b2f377015fad20a
-
SHA1
ed092d88c7b6595cd1a93c1e4feddea1e5d82ec1
-
SHA256
5ff726015653fbcb219c3fd9c56280292d53cf36ddea8903bd32331ae7a3cbff
-
SHA512
af127522f4032639fc749b7a837528593ba4c9c2af74382db06e9f2e1878f47d96d1e696b08f8bf61d4ca16349c98bc6df6149439af88c48a997b6fb8e452b48
-
SSDEEP
1536:xUp3WmO4r2N6GUOCxLkSJFygejo+sWuW9NnfPNjTYgbD1:xrpjUOCV7JF2jo+buW9VP1TBb
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/3300-0-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral4/memory/3300-3-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language July.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe 3300 July.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3300 July.exe Token: SeShutdownPrivilege 3300 July.exe