Analysis

  • max time kernel
    94s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 04:04

General

  • Target

    $TEMP/fzhjd/1.exe

  • Size

    265KB

  • MD5

    06638c30eb899390f4ceec295112c454

  • SHA1

    3727f286cb1738d6b3006f63bdce0844d0883e6c

  • SHA256

    1ad42831c0fe590dc36ca89933781e1771637d19dea98968dfaf77a9e18a7b21

  • SHA512

    57795604d79cff4468d396b23de5a75bbd5b1dbbda0b67a270a151c717c26ec70534650e6fa12e18fe23f623b52c8eb143cc223b431a5245e7c509f53cc272fe

  • SSDEEP

    6144:2u3dwQ0I2aFB2u0K/NAixgmMvYkuvPssyDn:nN9FQuX/9xgHvf0ssyr

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Modifies registry class 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\fzhjd\1.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\fzhjd\1.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    PID:3872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

    Filesize

    90KB

    MD5

    d553b62a8136d41289513c6405efea2d

    SHA1

    db48c3fd3993ff20511e47ffad14bfbdb9f438eb

    SHA256

    ce7cfb626807084186b248bbf2ef776eac086da936146f7d44956c2fcfaec1f8

    SHA512

    4a3767e8ac1e684a9a6eaced921b9599e34d5a4e83f034c7fe42bd8fd707a2b86f51ad485933fed5015554c3f9c4cf4b1357832964cc170d8cba86092fc9d2e2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BaiduBar.dll

    Filesize

    468KB

    MD5

    ce09bbf273e67347f2264d66005cba07

    SHA1

    7751ab1dcf3bb52083ecc4d00621d743131726f5

    SHA256

    97176d434158d5c96afbfabdeaf2601702c25fa76787a767e24d71860e74985d

    SHA512

    09f147b08a57ed15eff997031babb462b914b522020fa2570b1f5d46d012d8d87e7f6fb9efa6b12f1bb72af5ac85d577e426787179249dfaaf6a5d48b3acf6b1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.inf

    Filesize

    588B

    MD5

    68de0fe08e5fb18e8bfec79d4656024d

    SHA1

    2a5915f5b12608fd6900f90a66bfc2172e860cb1

    SHA256

    f4af37e13c25026347410f7750946212a5f70afb40fe497a6020fea34d18d550

    SHA512

    9be25d7bc97438b5c5ef63c932ef914e69cb7cb2f8b084db1870640662a764bc767ca1c0c19e5ede2e05c84df20749ffcae1feb95ca698dfb1c78d352e002ddc