31dcf3ead048f0a0ae0e23fe431018236fe79b5e596d1ff52b9cc5c63d5ea87a

Analysis

max time kernel
57s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BaiduP2PService.exe
Size

508KB
MD5

012a8879efa6f8dbc3c6ba58a659fefb
SHA1

d2a2dac321ff5a78de52e926044ba362f4004cde
SHA256

774839fe17e1ff94e45a21e6c1ac3c884e8fa0a3cb5ef24e9b8ae503d70dfa66
SHA512

b0f060cd5231f255083e2437026488d5fa3493e97cebb83a4638680551299db1a01862ca433d52efa8ecff80aa6ba5982cdd015a9f5081364b80ee92b79b78ba
SSDEEP

6144:U8gMpf4m7W+fAKNc2WZkYnTBkrkw2+68o9xzPi/uKhUrpdrFuq1LbSw37k4jdOvq:6AN7hnYTCrepPi/7IpxLmwjjdOgH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

BaiduP2PService.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BaiduP2PService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BaiduP2PService.exe

C:\Users\Admin\AppData\Local\Temp\BaiduP2PService.exe
"C:\Users\Admin\AppData\Local\Temp\BaiduP2PService.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPlayer\P2PCfg.ini

Filesize
189B

MD5
ebc6ba80c67ed1589132214235fadfdf

SHA1
fdc9b14730c238b55042e31aba7c638a3953be6a

SHA256
7b054c3203d0c3038cfca266b2e15a89f33edbdb4fcd70ae8bca4b70cab30aed

SHA512
f2c553ec67098285f9ac23c8cb094a817dbcdd03345625b8bc17e7c053fbd27ba0bec37ff22c254fb3064b0562ac9a765db5f1a7d66ca9485bf5d2ecbe875ea6

Download Submit
memory/2640-0-0x0000000000230000-0x000000000028D000-memory.dmp

Filesize
372KB

Download
memory/2640-3-0x0000000000290000-0x0000000000314000-memory.dmp

Filesize
528KB

Download