Overview
overview
10Static
static
3-°¦n+¦++.exe
windows7-x64
1-°¦n+¦++.exe
windows10-2004-x64
1PC远控测试-.exe
windows7-x64
1PC远控测试-.exe
windows10-2004-x64
3vip文件�...��.exe
windows7-x64
10vip文件�...��.exe
windows10-2004-x64
10菲律宾�...P4.exe
windows7-x64
6菲律宾�...P4.exe
windows10-2004-x64
6远程控�...2).exe
windows7-x64
3远程控�...2).exe
windows10-2004-x64
3远程控�...2).exe
windows7-x64
3远程控�...2).exe
windows10-2004-x64
3远程控�...�-.exe
windows7-x64
3远程控�...�-.exe
windows10-2004-x64
3远程控�...�-.exe
windows7-x64
3远程控�...�-.exe
windows10-2004-x64
3钱包收�...2).exe
windows7-x64
3钱包收�...2).exe
windows10-2004-x64
3钱包收�...�-.exe
windows7-x64
3钱包收�...�-.exe
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 21:27
Behavioral task
behavioral1
Sample
-°¦n+¦++.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
-°¦n+¦++.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PC远控测试-.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
PC远控测试-.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
vip文件捆绑器.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
vip文件捆绑器.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
远程控制 测试- (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
远程控制 测试- (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
远程控制 测试- (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
远程控制 测试- (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
远程控制 测试-.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
远程控制 测试-.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
远程控制 测试-.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
远程控制 测试-.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
钱包收款地址强制更改器- (2).exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
钱包收款地址强制更改器- (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
钱包收款地址强制更改器-.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
钱包收款地址强制更改器-.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
vip文件捆绑器.exe
-
Size
1.4MB
-
MD5
234673b74b8cf63fd7632fd016d5bf97
-
SHA1
b8879f89fb52c9a28adf6cb7a76fc4153a9ee498
-
SHA256
4f60677b90c4ef6a130b8df6ecacce77b8a3c10e2a38d9e76b03b169ae83f4cd
-
SHA512
5994c95447a37afae559dd4846b8ca9af4e6dd6450145d3201ecc66cfd0377b61bbc47a454f6934e08fe2bc1c64b5ed8705e2006542e8029cdd5ae7551107b13
-
SSDEEP
24576:89BQEqTGgNnJhiK54h0IvBkEp3W8AD/Dhd+y4lqJ8QdCYDoDNKn0RbpaoG8vn+Q:83XgtJhT9IvBsvD/DX+y4onCYDoDlNao
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" vip文件捆绑器.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vip文件捆绑器.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" vip文件捆绑器.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" vip文件捆绑器.exe -
Disables Task Manager via registry modification
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vip文件捆绑器.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" vip文件捆绑器.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vip文件捆绑器.exe -
resource yara_rule behavioral5/memory/2112-7-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-6-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-5-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-4-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-3-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-8-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-23-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-26-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-25-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-27-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-28-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-29-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-30-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-31-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-32-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-35-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-36-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-38-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-40-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-39-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-43-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-47-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-61-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-66-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-68-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-69-0x0000000001FA0000-0x000000000302E000-memory.dmp upx behavioral5/memory/2112-72-0x0000000001FA0000-0x000000000302E000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe vip文件捆绑器.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe vip文件捆绑器.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe vip文件捆绑器.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe vip文件捆绑器.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE vip文件捆绑器.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI vip文件捆绑器.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vip文件捆绑器.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe Token: SeDebugPrivilege 2112 vip文件捆绑器.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2112 vip文件捆绑器.exe 2112 vip文件捆绑器.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 PID 2112 wrote to memory of 1112 2112 vip文件捆绑器.exe 19 PID 2112 wrote to memory of 1196 2112 vip文件捆绑器.exe 20 PID 2112 wrote to memory of 1244 2112 vip文件捆绑器.exe 21 PID 2112 wrote to memory of 628 2112 vip文件捆绑器.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vip文件捆绑器.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1196
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\vip文件捆绑器.exe"C:\Users\Admin\AppData\Local\Temp\vip文件捆绑器.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:628
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5