Analysis
- max time kernel
119s - max time network
127s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
19/10/2024, 16:27
General
- Target 希望龙将辅助V1.10.exe
- Size 1.6MB
- Sample241019-tx7zlsxepp
- SHA256 e83e7836be434c12a11cc67f5516f25c7a6ff882fa813ab63320f1343ca317a9
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\希望龙将辅助V1.10.exe"C:\Users\Admin\AppData\Local\Temp\希望龙将辅助V1.10.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2648-9-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-11-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-19-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-21-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-20-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/2648-15-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-27-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-51-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-55-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-58-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-53-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-49-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-47-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-46-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-43-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-41-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-39-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-37-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-35-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-33-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-31-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-29-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-25-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-23-0x0000000010000000-0x0000000010051000-memory.dmp
memory/2648-59-0x0000000000410000-0x0000000000411000-memory.dmp
memory/2648-60-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2648-62-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/2648-61-0x0000000010000000-0x0000000010051000-memory.dmp