1eef30fd6f5da9d83d52a26be2a1ae71b47e7a45a6356c15aec011688debb700

Analysis

max time kernel
164s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
360anquanweishi.exe
Size 3.9MB
Sample260720-w31tlac191
SHA256 1eef30fd6f5da9d83d52a26be2a1ae71b47e7a45a6356c15aec011688debb700
MD5 5b333ea71ae2d4f60278c364d916a90e
SHA1 7f7d90fc6f52a96033ce6df9f13b0b0a363f109c
SHA512 03f350b96dd499c485ba02e02cf1377933f6a28f2b990acf807e8b990caa5cd8382dde56a1e3b07db79b26412de0ff3784565571abdbf21524084d56b33e4b44
SSDEEP 98304:4VbTVFfe6U4FL8VtL0hviDfHraEY1qhJonrnYtcW:cT3fq4yVBDfLawkk
TLSH
T1171601113BD1C075C1B31932DB78E65A4EF5AD314B314BCBA6983A2E5F34EC1AA39316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	360anquanweishi.exe
File opened for modification	\??\PHYSICALDRIVE0	360anquanweishi.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\360Safe\{8F5F2A0F-0FFF-43b0-8321-CB2F0EE0F95A}.tf	360anquanweishi.exe

Loads dropped DLL 2 IoCs

pid	Process
4132	360anquanweishi.exe
4132	360anquanweishi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360anquanweishi.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	360anquanweishi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	360anquanweishi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	360anquanweishi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	360anquanweishi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	360anquanweishi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	360anquanweishi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	360anquanweishi.exe
4132	360anquanweishi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4132	360anquanweishi.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4132	360anquanweishi.exe
4132	360anquanweishi.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4132	360anquanweishi.exe
4132	360anquanweishi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	360anquanweishi.exe

C:\Users\Admin\AppData\Local\Temp\360anquanweishi.exe
"C:\Users\Admin\AppData\Local\Temp\360anquanweishi.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 3KB
SHA256 d9c6f30e6ffeae7854236ecc2b6f19346f2b7a6b5633bdc0888f127b1afcc492
MD5 3200d0d89aa367d1887b3fd35d3ef4c8
SHA1 9c75abbda288dbd91c4f872cf40398f87e31ea0f
SHA512 de8a727a3be6855d2a7e4e6b1f1424163258806db7814ace8928208d903a7a77b132f57ada4080747a3dcc47df56a364f4357a9947827717f5ea9778fd05da39
TLSH
T124715D8E5BCB17DBD3F4F9FC1A20C3B591A87C124FD2A820B29DD1549AA9F20868D241
MD5 SHA1 SHA512 TLSH

Submit Download

computer_rescue_icon.png

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\computer_rescue_icon.png
Size 838B
SHA256 e4b839057fcf4fa07d8e84e1a83f1096cf36c89a2f19f692d4ffbfd0706c62b4
MD5 3090d2de85382dff85b62ba401ad154a
SHA1 ef99c36242f2b16b8f5c124bf045d435cec0858e
SHA512 05d16c277259fdcfada9aa2bfdb88de1356e7b1384ea24686821af3bf3c127d4ed2c1f26aeb4b87d23747fa4ea6e46f95756c980bf7501221384495219149665
TLSH
T1D70186E2E150E79C889F36075B0F65915DA214C2A143694F3DFFE995490B4CACBE0B94
MD5 SHA1 SHA512 TLSH

Submit Download

custom_wnd.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\custom_wnd.ini
Size 2KB
SHA256 045219484debeafdcedb04e6fd0c914cb4db13a712b2abdad75b33696f28f7ac
MD5 9b112c4f740a4e1454b5c799f858727d
SHA1 40349402d12d0de24332a99baf007054f6d46b1d
SHA512 5d2c68cd2fe2444100a1a3031d33b1f6c186384af40c943d711e5b39a29bf9592e59e45d5b35fab59415db86b5abd926ee58aadd857a3868672ff3e648a63907
TLSH
T1A241769726F99006F9B78B62EA7118B16B32BD52AC1CC50C69D0954D84EBD85C5333F3
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Size 1KB
SHA256 3c2dc08c7d222f4d2b431fdec2f9bc109ea17216e5b44ea8da397799a8cae726
MD5 4f7708677e7d6cba851d48d0619434bf
SHA1 4c7959d01e51fd4a9f514d71d83936d69ed6f2d8
SHA512 5768506b76a1773e8b716e0a0a787ee03127533d2bf8c18ea3da8446e45bfd8a892b11ae7084247a376f13764a080313d3c6d9d686bd200836a6e589cf0e96e7
TLSH
T15D21510CC702C392A0068437B22341A4A87B370695E2B95872B22C5C3A39456BE5E3CA
MD5 SHA1 SHA512 TLSH

Submit Download

soft_manager_icon.png

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\soft_manager_icon.png
Size 646B
SHA256 4c2639778afba2c0d782996ea8a80152ed25ac2a954f3d525960583bddd12090
MD5 8f7051f0e9b7b4ce87f82dc64fc57972
SHA1 77b7122ee16b8d7141323e5b66b7a2f390265bcd
SHA512 6ebf53ed208c4d6840678074f23fec27735939a948f277f8bf6d2cd6888a13ec6086147d417daf5eab7c3887e2ca4dc64a23579e93238f186faec2d46f8a2501
TLSH
T17AF09ED1D429FAD9DC0F22174A140916BD9205C6158A5B5B8E95D026283FECD5664F44
MD5 SHA1 SHA512 TLSH

Submit Download

360P2SP.dll

Path C:\Users\Admin\AppData\Local\Temp\{0661F7DB-ABCD-4835-8CBD-964363C173F3}.tmp\360P2SP.dll
Size 688KB
SHA256 0eca2e140f973b2011c633d4d92e512a1f77e1da610cfe0f4538c0b451270016
MD5 d875875eb3282b692ab10e946ea22361
SHA1 34bcef8a8cb0e1db44671892ac3cbd74d3c541a8
SHA512 972466310d3c145141320584b5f3e431c6888bda2ba1036f85e68e534ed6fb97ba04cbd46d8d9c401dc5857100dc1bff1bad82b50514f3e5c582522f22fd2b5c
SSDEEP 12288:1IhyxJ3BYXF6WxYC2aeHACRYlH+ZOAyTjUnIgidGtAd8Rwb33+YnBsLS683wK9T7:ih8WxYCyYlaOYnliItjRwbH+YBsLS68N
TLSH
T133E4AF1337C08035E2BB0675DE699225AAF9BC704A358A9F63D0854D7E74BC3CA35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sites.dll

Path C:\Users\Admin\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll
Size 1.4MB
SHA256 c1eb83993c85e01ee6ae84eb6e05744ff8c3ccc02c41d09c22286e3012ef46fc
MD5 a2ff2c72e739e0cf4c73b623444ca39d
SHA1 ff886e63c894a20f30c136a8264cfa33d41b8331
SHA512 844dab35a1625d5bf1bd814a36fb80d5670d3dfee5cf65ad8be53784b486dcc08898b7577a323c7c7e1e83655f861ea86c5453cfa4c3d55353d329ef3af6320b
SSDEEP 24576:l4LEubC/9euoUCi82BbjSyM5hGfzmzJHXW+U0:UEubUo1i3eymhGfizJHK0
TLSH
T1BC65AE1237D1C57BC17E1371DA1AB3F697FAE2301A35A547A7C84B1C2F30A83D629A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4132-31-0x0000000006680000-0x0000000006681000-memory.dmp

Download

memory/4132-114-0x0000000006680000-0x0000000006681000-memory.dmp

Download