939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
Size 1.7MB
Sample260824-dl6dmscm31
SHA256 939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d
MD5 c0b9b7787a7ec444b3173370b22f5687
SHA1 ff524300fa432e2327adc5ecd8d68f538afc7a7e
SHA512 3811c4604221ff4d09182c5f1336e15027f8a8558ee7acbd579b337f37f172fd03191e2ad360c16a1ebfc1f28aad55eafb102791bc1cbd1af501c298ac5b30cb
SSDEEP 24576:I7QW2eaelVFUJM7x/ludq7Z38urBIa0XMXHqq8NxGATZr9/A7o7g7X7ew7:elVFUJMNdudq7Zswl0XMXKjTZr93
TLSH
T19F85124933E88BA0C9FF4BFE59F042618779E5576A03E75E0ED514E809A2742CC1CAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2328	CostBackupService.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\造价文件备份管家\CostBackupService.exe.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\CostBackupAdmin.exe.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\CostBackup.Common.dll.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\使用说明.txt	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\EngineeringFileBackup.exe.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\CostBackupService.exe.config.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\SecureLicense.Core.dll.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\造价文件备份管家.ico.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
File created	C:\Program Files\造价文件备份管家\Uninstall.exe.new	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2632	sc.exe
1212	sc.exe
4716	sc.exe
3228	sc.exe
4228	sc.exe
428	sc.exe
4172	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4228	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	88
PID 3416 wrote to memory of 428	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	90
PID 3416 wrote to memory of 4172	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	92
PID 3416 wrote to memory of 2632	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	94
PID 3416 wrote to memory of 1212	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	96
PID 3416 wrote to memory of 4716	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	99
PID 3416 wrote to memory of 3228	3416	939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe	101

C:\Users\Admin\AppData\Local\Temp\939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe
"C:\Users\Admin\AppData\Local\Temp\939e95d0aa7f6aa71f345d3285c9ffa5ed2922b4f1c57d9e5e72d6f050e3dd3d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "CostBackupService"
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" create "CostBackupService" binPath= "\"C:\Program Files\造价文件备份管家\CostBackupService.exe\"" start= auto DisplayName= "造价文件备份管家安全服务"
  2⤵
  - Launches sc.exe
  PID:428
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" description "CostBackupService" "独立身份运行的造价工程文件隔离备份服务"
  2⤵
  - Launches sc.exe
  PID:4172
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sidtype "CostBackupService" restricted
  2⤵
  - Launches sc.exe
  PID:2632
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" failure "CostBackupService" reset= 86400 actions= restart/5000/restart/15000/restart/60000
  2⤵
  - Launches sc.exe
  PID:1212
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query "CostBackupService"
  2⤵
  - Launches sc.exe
  PID:4716
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start "CostBackupService"
  2⤵
  - Launches sc.exe
  PID:3228

C:\Program Files\造价文件备份管家\CostBackupService.exe
"C:\Program Files\造价文件备份管家\CostBackupService.exe"
1⤵
- Executes dropped EXE
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CostBackup.Common.dll

Path C:\Program Files\造价文件备份管家\CostBackup.Common.dll
Size 25KB
SHA256 f90c6bd43d8c570c174d25288825d24a4ecba03b57b22cd5be4352f60ebbbada
MD5 43cdc2ba5a93272444952b18095dc26f
SHA1 85b51803a3077352ed51ae398cca2ce16434a7e6
SHA512 28ab8d2446c26b5593b98d0ba3a7171e77f2b0cdf0eef427e4e01344b014819dc0f418941cea29d52b4b166e3689e4d900a9ef39ac388a9f0bff9d4891cfd87b
SSDEEP 384:hQ7zsCd84N3+NRMIWyS1fEGM+A3yRh/zeJ38EOBoRhgxRQbq70/QD:hGsfKdviy/z68lPsC
TLSH
T1A3C2FA1873E86110D97FCBFD89F066640335952BDC27EA1E0CDF61B84961B98C968BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CostBackupService.exe

Path C:\Program Files\造价文件备份管家\CostBackupService.exe
Size 119KB
SHA256 df28233e0413c6d5376adc45e59e937bb033c8116791fa75c4049bf1fc18c59f
MD5 b81160fa1ce4f3b4a2b495388a3dca37
SHA1 f5b3a7653d0f860320cad4458643c094ddc2e0e1
SHA512 d753350ae9b9aa6c019ca37677772d868e771405e086fc16f2d0400f91c6e708c0661b9f71748895f28697da5027af9b55e8471c9579264133bb28d57e910d32
SSDEEP 1536:6h8XWpp9M08w80k8cfYqx6Fn5ki10VyKTW3zbfSsRtUhrUagxVVBO5YBZy:6XK2yi1dq2WmzVV85YBZ
TLSH
T147C3289873E88E26D9BF1BFB847052044B35F497EA83F31E0ED494DA1A62791C91D4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CostBackupService.exe.config

Path C:\Program Files\造价文件备份管家\CostBackupService.exe.config
Size 222B
SHA256 c5a7d5e7398589f5977a51a312ed2e73025d1adc73857b25b373249ed31af91b
MD5 a7ab80f506bf96d09c395b2e9a3d25b8
SHA1 4093f50d51578f307e368206d31573da1f14a272
SHA512 4326aa432fd118afa16a2fbcf8f6b318ac34e61a76b852576cb74eda4094a44d18a44952bb254eff2bea621fb2b15444ef4d155f609afa69e990a15eac678454
TLSH
T102D0A972AA60C8A261410F16C32288059BB2B3F5A42D4888ECB7BC604ACA3280B73248
MD5 SHA1 SHA512 TLSH

Submit Download

SecureLicense.Core.dll

Path C:\Program Files\造价文件备份管家\SecureLicense.Core.dll
Size 12KB
SHA256 b9c01b858fb192f4525634bd0458d7a3707d3c5555a5dba8210395dca034b31d
MD5 1db077088a8b4c8432aab3af87946788
SHA1 dd3dadf12fc4213b9c26c9c9a88dcbadd0fe40d9
SHA512 4be22ef426a74e2faf5172e8e155085e8cc42975ad45b4c0ab0939624ea0ed16a0ca322fa269993a8b16c0c8e492afeed9cb87482b8618a5621b7adece04007d
SSDEEP 384:Z4Ffuj1FDswT8rUQy6jTgBtP3JdpHUTSUuNHho:PtQyd0juNHho
TLSH
T10942E82877D48408F9BF4B7A5DF0A3A4946FFA932A17A32F05D3501619367E5EE18E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\ProgramData\CostFileBackup\settings.ini
Size 1KB
SHA256 0ee7e5aa6697961a317131fcc18e00b8db15dd82a8c489791eba78342a23808c
MD5 2074564170af56449f1aff050c6059f0
SHA1 dcd7149fe5bdf3a98014803ec9b3027741983a7f
SHA512 aa18f9c24fdb141a71f956bf292cf27e41ecd9d313c564bb2fcf841fe82d08d987c9d142332af62be3bc413bb5ebcf8b4e0acc4d155b5c2b3535b4702cd066f5
TLSH
T1A6216645E5EE9E5558D8B1FBCF17812D907DF401685BB20A99C0074835DCC787F1D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2328-43-0x00000000006D0000-0x00000000006F4000-memory.dmp

Download

memory/2328-45-0x0000000000E40000-0x0000000000E4C000-memory.dmp

Download

memory/2328-61-0x0000000001100000-0x000000000110A000-memory.dmp

Download

memory/2328-47-0x0000000001820000-0x0000000001870000-memory.dmp

Download

memory/3416-41-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-4-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-3-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-0-0x00007FFD2973F000-0x00007FFD29740000-memory.dmp

Download

memory/3416-37-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-2-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-26-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-1-0x0000000000440000-0x0000000000604000-memory.dmp

Download

memory/3416-38-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-62-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download