Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2024 02:59
Static task
static1
Behavioral task
behavioral1
Sample
.qq/DesktopProjection64.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
.qq/StartDes.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
某学校老师大尺度照片.docx.lnk
Resource
win10-20240611-en
windows10-1703-x64
General
-
Target
某学校老师大尺度照片.docx.lnk
-
Size
1KB
-
MD5
7827df6cbcb26d312fe460969e575961
-
SHA1
f0f1ab0eebc1e8742c46dd5b274ff81c31d9a11a
-
SHA256
26503e34c6a6c223a97e8474be2ceddb595ca186818ea32350fdf04fa0452532
-
SHA512
6e25ba5101f2d6ed2d7e15165db78fce91864e07d2509e12010e90fc5f83d8d43550578e522c51c37e1a42e6e0c19c29304b6c065203e8979d17ed556bd467d9
Malware Config
Extracted
cobaltstrike
391144938
http://1.94.24.185:443/cm
-
access_type
512
-
beacon_type
2048
-
host
1.94.24.185,/cm
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCMsDqm9W6IsM1H0kwwouCSdOtfKtrdgLGrIAur9uDZu9k5rpwy+tY+2PoFsVItxEES0aliTdBvGxtn9JUqMka9wqIbprDB5RE3rHM+V2dUqaZTKhASck1NdefeIOPddsfPQJEi01z0Fys6ZP7Ls7w8W5k75mc9QTvHFZMcgnj0iwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20120121 Firefox/46.0
-
watermark
391144938
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 200 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 200 taskmgr.exe Token: SeSystemProfilePrivilege 200 taskmgr.exe Token: SeCreateGlobalPrivilege 200 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4476 wrote to memory of 2512 4476 cmd.exe 72 PID 4476 wrote to memory of 2512 4476 cmd.exe 72
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\某学校老师大尺度照片.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\.qq\StartDes.exe"C:\Users\Admin\AppData\Local\Temp\.qq\StartDes.exe"2⤵PID:2512
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:200