fe9ab50f0f288e7b26df6b02f2217049143ab4fe7d56d5953e3b88998e520127

Analysis

max time kernel
300s
max time network
304s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
huyanbao_last_v3.1.exe
Size 6.9MB
Sample260905-rffspadn8z
SHA256 fe9ab50f0f288e7b26df6b02f2217049143ab4fe7d56d5953e3b88998e520127
MD5 9bd1b5ab09cf3057d610ea8a4997b786
SHA1 36c71659bd58a1892756806e05bb022404f30af2
SHA512 b8c63d37bd277baf015da387a3c22c77343102a60af859193ae8ff88305b617d3bbbb199aeb8b77598556b888882adbdfa312d01a1aabb246cbedcbe295bdfeb
SSDEEP 98304:S3PUzk6t0rDK2BjDyXtDGOb6bp/4gLY3KIbbLnMrhXbCM6QpWJEUKquSKI/8nO9N:SmJ2aEjDyXtDR6b1J2MluM6QpguSKpdC
TLSH
T1037623940617938BE69C3636C7570C6EB2661D79E170861A9520F9EE20FF207CEF74B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6024	HuYanBao.exe

Loads dropped DLL 5 IoCs

pid	Process
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\护眼宝\uninstall.exe	huyanbao_last_v3.1.exe
File created	C:\Program Files\护眼宝\resources\chunk.blob	huyanbao_last_v3.1.exe
File opened for modification	C:\Program Files\护眼宝\resources\chunk.blob	huyanbao_last_v3.1.exe
File created	C:\Program Files\护眼宝\HuYanBao.exe	huyanbao_last_v3.1.exe
File opened for modification	C:\Program Files\护眼宝\HuYanBao.exe	huyanbao_last_v3.1.exe
File created	C:\Program Files\护眼宝\uninst.exe	huyanbao_last_v3.1.exe
File opened for modification	C:\Program Files\护眼宝\uninst.exe	huyanbao_last_v3.1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HuYanBao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huyanbao_last_v3.1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe
3868	huyanbao_last_v3.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6024	HuYanBao.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3868	huyanbao_last_v3.1.exe
Token: SeSecurityPrivilege	3868	huyanbao_last_v3.1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6024	HuYanBao.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6024	HuYanBao.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6024	HuYanBao.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4780	3868	huyanbao_last_v3.1.exe	80
PID 3868 wrote to memory of 4780	3868	huyanbao_last_v3.1.exe	80
PID 3868 wrote to memory of 6024	3868	huyanbao_last_v3.1.exe	91

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4780
- C:\Users\Admin\AppData\Local\Temp\huyanbao_last_v3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\huyanbao_last_v3.1.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\护眼宝\HuYanBao.exe
    "C:\Program Files\护眼宝\HuYanBao.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HuYanBao.exe

Path C:\Program Files\护眼宝\HuYanBao.exe
Size 4.9MB
SHA256 e6ff1a6d784500d4a10ebc65da089417116de6332175a44a64593bdd23e024ec
MD5 c5475cb4d350a8c8ade70fd32187325a
SHA1 b611a53316d24acea072bf371c9c46963c1b8391
SHA512 cc566e0c10111dbf72f4b0286ef4edcec90047e79ff5213c2a2e75eeab605d671a9de9a0e989e99d4814b3728888700a34d8940a08ebb77fd57d382bcee26632
SSDEEP 98304:YSXX8f/47cvoRasMDHqKwRsfnxlek12jajAxWuN8C+8i1qD1A/LdQZklBIpH40SQ:Y4JKBze2cKAxWuN8C+8i1qa/kSIpHfP
TLSH
T12036D02136608176C13E2132955BB36FA979AD601B3141C77598FDFE2BB12C35A3B23B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslACD6.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nslACD6.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nslACD6.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nslACD6.tmp\nsis7z.dll
Size 1.3MB
SHA256 2d24132e09a2bd434cadd3e4b0f9fa6f5eb8630a3d8b2bd6de6ce88d96e9707b
MD5 bd67fe303f31bf19947a55d11d7bcfa8
SHA1 3a604c448f5a04ba00d1572b0801b1803d34c5e3
SHA512 65183447b7596b239b14fe2da57cb93e0c2ada3bcabebd9addf351d13f31dc6b6cd41184b6672095456a06482567e58d03a04eaeeb687ef0e73ed7ae9130e13d
SSDEEP 24576:8fiWl61crAGr8RH+tzB+GRK/vjA/Gt/Vw4e5:qJjr8R0B+EQvjA/Gta5
TLSH
T14D558E51EDB280FAC14F9770D53D673BAA3253178E1C4D6FDA689EE85C31660F20A12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4780-19-0x00000000061E0000-0x0000000006477000-memory.dmp

Download