782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/01/2025, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024.12.31止尾款结算对账核对表xlsx.exe
Size

1.0MB
MD5

33961801df7df4040fb2282d6103286c
SHA1

1c0b29fa3a333974788a71c896e30f38e2bf3769
SHA256

782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a
SHA512

0d7a73ff1312de597fc71d3d5d0dda34e326ad2268a762695487547361a734568f21f1d0856dd9a502b704a9d5caa7ebc547baa329dc0f906ec003ca23dbd44a
SSDEEP

24576:CMjhKbkkc7tiPbWJF9WUqMFWsRvtciqgQRgOD39wKX:RI4kOtiTQWU4SciuRgC9T

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
656	2024.12.31止尾款结算对账核对表xlsx.tmp
2768	2024.12.31止尾款结算对账核对表xlsx.tmp

Loads dropped DLL 8 IoCs

pid	Process
1644	2024.12.31止尾款结算对账核对表xlsx.exe
656	2024.12.31止尾款结算对账核对表xlsx.tmp
656	2024.12.31止尾款结算对账核对表xlsx.tmp
1332	2024.12.31止尾款结算对账核对表xlsx.exe
2768	2024.12.31止尾款结算对账核对表xlsx.tmp
2768	2024.12.31止尾款结算对账核对表xlsx.tmp
2744	regsvr32.exe
2648	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024.12.31止尾款结算对账核对表xlsx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024.12.31止尾款结算对账核对表xlsx.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024.12.31止尾款结算对账核对表xlsx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024.12.31止尾款结算对账核对表xlsx.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2244	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	2024.12.31止尾款结算对账核对表xlsx.tmp
2768	2024.12.31止尾款结算对账核对表xlsx.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	2024.12.31止尾款结算对账核对表xlsx.tmp

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 1644 wrote to memory of 656	1644	2024.12.31止尾款结算对账核对表xlsx.exe	30
PID 656 wrote to memory of 2924	656	2024.12.31止尾款结算对账核对表xlsx.tmp	31
PID 656 wrote to memory of 2924	656	2024.12.31止尾款结算对账核对表xlsx.tmp	31
PID 656 wrote to memory of 2924	656	2024.12.31止尾款结算对账核对表xlsx.tmp	31
PID 656 wrote to memory of 2924	656	2024.12.31止尾款结算对账核对表xlsx.tmp	31
PID 2924 wrote to memory of 2244	2924	cmd.exe	33
PID 2924 wrote to memory of 2244	2924	cmd.exe	33
PID 2924 wrote to memory of 2244	2924	cmd.exe	33
PID 2924 wrote to memory of 2244	2924	cmd.exe	33
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 2924 wrote to memory of 1332	2924	cmd.exe	34
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 1332 wrote to memory of 2768	1332	2024.12.31止尾款结算对账核对表xlsx.exe	35
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2768 wrote to memory of 2744	2768	2024.12.31止尾款结算对账核对表xlsx.tmp	36
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37
PID 2744 wrote to memory of 2648	2744	regsvr32.exe	37

C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\is-MD45U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MD45U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$400E0,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe
      "C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\is-3BA9U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3BA9U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$301EA,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\system32\regsvr32.exe
        
        /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"
        7⤵
        Loads dropped DLL
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\UptightChicken.dat

Filesize
1.4MB

MD5
f7af43ee4b917ecc5051c5cb3a0ffe5c

SHA1
786c74765b5121ab1fa431fc02d8dfd54eae9458

SHA256
a43e88349c0757c3f122657e6696becde5316f9c31764eaee04e722a87f4b15b

SHA512
6d7872e536e1c4aad3dc06f3d244c2f40bfe2dda417c7555b2387b98fe9bab88654db05ba9dfeadd29959cf9c44a16205e6a95d3465fbda77e6c95344a09b5b7

Download Submit
\Users\Admin\AppData\Local\Temp\is-CBO03.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MD45U.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp

Filesize
1.2MB

MD5
75c6fbc94f75010aebb8c0c11a646fcc

SHA1
00de6a9f9b02ac9e24db302fc705420740ca9029

SHA256
ba9099f858da9b41bae8a46ca4b8a61b099a18cdbf43bcd3a2c31c0b8e30bede

SHA512
e7f8d81d430258a3ddb07e2798cceb2a8cdd2e3150cdce8e88b745dfdf14f3491076212256a7d3c1b43217c47dd182c9822b4e9da34dbcf7760cbf05d525602b

Download Submit
memory/656-10-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/656-39-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1332-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1332-37-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/1644-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-41-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2768-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download