Overview
overview
7Static
static
7?????10?/2_p.exe
windows7-x64
1?????10?/2_p.exe
windows10-2004-x64
1?????10?/?????.exe
windows7-x64
7?????10?/?????.exe
windows10-2004-x64
7?????10?/bbxcomm.dll
windows7-x64
1?????10?/bbxcomm.dll
windows10-2004-x64
3?????10?/bbxinput.dll
windows7-x64
7?????10?/bbxinput.dll
windows10-2004-x64
7?????10?/jianpan.exe
windows7-x64
1?????10?/jianpan.exe
windows10-2004-x64
1?????10?/soundbox.dll
windows7-x64
1?????10?/soundbox.dll
windows10-2004-x64
1?????10?/tool.dll
windows7-x64
1?????10?/tool.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:39
Behavioral task
behavioral1
Sample
?????10?/2_p.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
?????10?/2_p.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
?????10?/?????.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
?????10?/?????.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
?????10?/bbxcomm.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
?????10?/bbxcomm.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
?????10?/bbxinput.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
?????10?/bbxinput.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
?????10?/jianpan.exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
?????10?/jianpan.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
?????10?/soundbox.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
?????10?/soundbox.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
?????10?/tool.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
?????10?/tool.dll
Resource
win10v2004-20240508-en
General
-
Target
?????10?/?????.exe
-
Size
1.4MB
-
MD5
06c7bb0ae19c1da9066a41d1466c19fb
-
SHA1
8d2f19b96c4c29fe16626c595fc22cf78be827c9
-
SHA256
2db99fd17f60f09535435db87d7ac89a5ce36057272cce14bf70fe54f81ad056
-
SHA512
1b732e8a83735671e3985b45e55724eff6da3179a890a4c1aee57c1130117ad60324ac8107634a3030af2d9591fbf7534e1eeca80ea45f4517ce014efc739a27
-
SSDEEP
6144:JSGVR4r4ICts0uMsTB0/yn3WVQZLtXSDsYiOP9SeFI1KY7ipmXXJ57Defu5mLQ+t:YGVCcM3B3EVPFu5mL
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral3/memory/2460-28-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-31-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-34-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-32-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-46-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-47-0x0000000006580000-0x000000000674C000-memory.dmp upx behavioral3/memory/2460-48-0x0000000006580000-0x000000000674C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
_____.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main _____.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch _____.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" _____.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
_____.exepid process 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
Processes:
_____.exedescription pid process Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe Token: 33 2460 _____.exe Token: SeIncBasePriorityPrivilege 2460 _____.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
_____.exepid process 2460 _____.exe 2460 _____.exe 2460 _____.exe 2460 _____.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2460-0-0x00000000749E0000-0x0000000074B96000-memory.dmpFilesize
1.7MB
-
memory/2460-1-0x0000000034730000-0x0000000034740000-memory.dmpFilesize
64KB
-
memory/2460-28-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-31-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-35-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-34-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-39-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-42-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-41-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-40-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-38-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-37-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-36-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-33-0x0000000075451000-0x0000000075452000-memory.dmpFilesize
4KB
-
memory/2460-32-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-43-0x00000000749E0000-0x0000000074B96000-memory.dmpFilesize
1.7MB
-
memory/2460-44-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-45-0x0000000075440000-0x0000000075550000-memory.dmpFilesize
1.1MB
-
memory/2460-46-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-47-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB
-
memory/2460-48-0x0000000006580000-0x000000000674C000-memory.dmpFilesize
1.8MB