3.4
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.53
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.7b4b3161 | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASIP [Trj] | 20240325 | 23.9.8494.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20231026 | 1.0 |
| Kingsoft | malware.kb.b.999 | 20230906 | None |
| McAfee | Downloader-FVF!3AF37FD3D859 | 20240325 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0bf61 | 20240326 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545273.62475 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545274.047125 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
检查适配器地址以检测虚拟网络接口
(50 out of 552 个事件)
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 156.254.147.137:443 |
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-ASIP [Trj] |
| Acronis | suspicious |
| AhnLab-V3 | Trojan/Win32.Agent.C2589213 |
| Alibaba | TrojanDownloader:Win32/Upatre.7b4b3161 |
| Antiy-AVL | Virus/Win32.Expiro.imp |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-ASIP [Trj] |
| Avira | TR/Spy.Zbot.amoan |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.36802.cq2@aSt9fnc |
| Bkav | W32.AIDetectMalware |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.3d859d |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| F-Secure | Trojan.TR/Spy.Zbot.amoan |
| FireEye | Generic.mg.3af37fd3d859d411 |
| Fortinet | W32/Agent.AEJB!tr |
| GData | Win32.Trojan-Downloader.Upatre.BJ |
| Detected | |
| Gridinsoft | Trojan.Win32.Agent.bot!s3 |
| Ikarus | Trojan-PWS.Win32.Fareit |
| Jiangmin | Trojan/Agent.hnzm |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Kingsoft | malware.kb.b.999 |
| Lionic | Trojan.Win32.Agent.lYpn |
| MAX | malware (ai score=83) |
| Malwarebytes | Generic.Malware.AI.DDS |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FVF!3AF37FD3D859 |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | Trojan:Win32/Upatre.AMN!MTB |
| NANO-Antivirus | Trojan.Win32.DownLoad3.clryhy |
| Panda | Trj/Genetic.gen |
| Rising | Trojan.Crypto!1.9E08 (CLASSIC) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.PWSZbot.pt |
| Sophos | Troj/Agent-BCMT |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-28 20:23:24
PE Imphash
bb9a68197a2dda6c8411f08fed623690
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00006000 | 0x00006000 | 3.4191889024472206 |
| .MPRESS2 | 0x00007000 | 0x00001000 | 0x00000400 | 6.08964226056419 |
| .rsrc | 0x00008000 | 0x00002000 | 0x00001600 | 5.021704654870794 |
| .imports | 0x0000a000 | 0x00001000 | 0x00000200 | 3.511396965723055 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00008078 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00006020 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00008fa0 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00008ff4 | 0x00000324 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00009358 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x4040b0 ExitProcess
• 0x4040b4 FreeLibrary
• 0x4040b8 GetModuleHandleA
• 0x4040bc GetProcAddress
• 0x4040c0 HeapCreate
• 0x4040c4 HeapAlloc
Library Winmm.dll:
• 0x40421c mciSendStringA
Library Msacm32.dll:
• 0x4041fc acmStreamOpen
Library user32.dll:
• 0x40414c LoadIconA
• 0x404150 LoadCursorA
• 0x404154 RegisterClassA
• 0x404158 CreateWindowExA
• 0x40415c GetMessageA
• 0x404160 DispatchMessageA
• 0x404164 DefWindowProcA
• 0x404168 PostQuitMessage
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
f?MZue
W<f:PEuYUBx
D$(D$,
1P>?GFFP
kernel32.dll
ExitProcess
FreeLibrary
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
Luser32.dll
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
open waveaudio
TranslateMessage
LoadLibraryExA
user32.dll
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
user32.dll
LoadIconA
t7Kt'Kt
Ms%0q0
%0q0`%0
$0n%00
%0Rich
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#3#############
33333333333@II#3#3###########
33333333333@+333##3#########
33333333@?a
+23333##3#######
332@j+23333333#######
j@33333333#######
2+jj23333333333####
$2+I@33333333333##
$$$$$2+@2333333333#
$$$$$$$
al2333333333
$$$233333333
C&SCCCSCS&&&&
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
TEE ,EM
E-BFSOE
E-CFSOE
E-5=bE
kernel32.dll
ExitProcess
FreeLibrary
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
user32.dll
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
A b o u t
M S S a n s S e r i f
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S C o r p o r a t i o n
F i l e D e s c r s i p t i o n
n o t e . e x e
F i l e V e r s i o n
2 . 0 . 0 . 2
I n t e r n a l N a m e
n o t e . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 0 5
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
n o t e . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 0 . 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ L i s a \ D e s k t o p \ B v Z H y i v D . e x e
C : \ E 0 k p _ k M P . e x e
C : \ f 1 f b b 1 3 b 2 8 4 f 6 b f d 8 e e 3 1 e 2 5 8 0 9 4 f 0 c 7 5 e 6 d e 8 6 f 8 1 4 c e d 4 4 3 2 d f 1 b e 7 a 5 c a b 2 9 8
C : \ U s e r s \ L i s a \ D e s k t o p \ v d x f C K i G . e x e
C : \ f 4 6 f 1 c b 3 9 a 4 3 3 9 8 8 3 b 7 9 e c 1 2 f a b 8 9 d 1 5 2 9 a 7 0 d 8 0 f f 6 6 3 d b 9 4 8 c 5 d 8 6 a c 9 4 b e e 9 6
C : \ 7 7 4 1 e 8 6 0 a 5 3 0 7 9 7 e f 1 3 6 3 3 7 b 7 e f 7 a 5 a 7 a b a 2 d b a d 8 a f a 8 9 8 7 d 4 0 a b b e 7 1 3 a 8 8 6 a 6
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c 0 e 4 1 3 3 e a c e 7 4 5 c 0 0 b 8 f 5 e d d 4 6 e 4 1 9 0 6 2 7 a f b b c 4 b 8 8 4 7 6 8 0 1 e 1 3 1 0 8 3 7 1 4 c 7 1 d d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ U A x k k 1 B 3 . e x e
C : \ 9 5 5 5 e c c 1 1 1 4 7 0 b 7 6 4 4 0 1 7 6 8 8 d 2 0 8 6 6 d 9 b 4 d f 8 2 b 1 5 0 b 6 3 3 7 6 7 2 d 3 e 8 f 9 0 a d e b 0 b 9
C : \ P 0 M u p l A p . e x e
C : \ 8 b a f e 5 f b e 1 2 1 d e c a 7 0 9 8 a 8 7 c 9 1 c 6 8 9 e 6 e 9 d 7 f b b 1 5 a 8 2 6 1 f e 2 e 2 d f 0 a 3 f d 3 b 8 b f 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X v P j q x Z b . e x e
C : \ 5 e 6 6 1 7 4 4 9 b d b c 6 2 5 f 4 9 2 e 9 1 1 c 2 e e a 1 1 2 3 c 8 6 5 a f 0 d 5 b 5 d e 2 a 0 c 7 6 2 2 8 2 f 6 3 0 0 5 d 4
C : \ c 0 a 3 9 9 9 e f 3 6 5 e 9 d 1 e 5 c 3 4 d 6 3 6 2 b f 5 2 6 c 9 a 5 c f 2 b 1 6 f 1 6 a 7 6 c b 9 9 3 c 3 6 6 1 a 4 b 7 4 c 7
C : \ k j i h 1 o A 7 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ p D 0 H j 5 D 2 . e x e
C : \ K W N o O D s h . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q e F l V O b q . e x e
C : \ 8 r A Z X O E 5 . e x e
C : \ b e 0 2 4 3 5 3 b 4 0 9 1 e 8 b 6 b 3 e 4 0 b 2 8 1 2 7 6 0 9 2 2 0 3 c 8 a a 9 f 4 7 f 4 b 8 c 3 3 1 f 6 c 0 8 0 d 6 e 9 8 3 1
C : \ 1 e 0 c 4 3 3 8 9 9 f 0 1 1 3 f 5 b 1 2 3 d 6 c e f 5 0 8 d 0 8 2 3 4 7 b f b b f f b 4 0 5 a b a 7 0 8 0 e 1 0 e c f 7 6 a 0 9
C : \ U s e r s \ L i s a \ D e s k t o p \ R X 0 w s B k c . e x e
C : \ 4 j 3 8 J j B t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P d 0 0 q n 1 4 . e x e
C : \ 4 g z g o Z 3 e . e x e
C : \ e 0 2 6 f a 6 2 f 5 6 9 6 8 6 e a d 4 5 e f 7 8 0 9 2 d 9 0 e f a c 7 e 4 c 9 4 5 4 8 2 1 5 4 7 d 7 c 4 d 6 6 d 0 4 f 3 e 2 4 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q M R I w G M O . e x e
C : \ m 3 K 4 R p 0 1 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G 6 b n 1 f a N . e x e
C : \ 2 8 e 3 7 4 7 8 5 d 7 0 8 e 2 6 7 d 3 8 c 8 6 5 e a 0 6 d d 1 4 6 9 e 8 3 3 e 3 f 3 b a 1 a c 1 0 5 9 2 c 8 a 2 6 b e f 5 6 7 d
C : \ b 9 6 0 9 0 6 7 3 2 c 9 4 2 2 f 4 3 2 9 0 8 f 7 2 d 4 2 a 4 c d d f 0 5 1 3 c a 1 f 2 e 9 9 1 1 b c c 0 1 3 d 1 e 3 a f 5 2 a 7
C : \ 5 c 9 d b 3 7 6 5 8 0 c 5 0 b 2 3 d 0 3 0 6 b d 5 4 2 e 5 0 b 7 e 3 6 3 3 b c 1 8 f 3 2 f 4 6 5 0 4 5 a a 9 7 1 6 c f a 8 d 2 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k P J U y B i R . e x e
c : \ t a s k \ 0 8 0 C 9 7 8 E 2 8 6 5 3 6 8 3 8 A 2 F 8 C 4 F E 5 7 A 7 3 0 B . e x e
c : \ t a s k \ 9 4 5 1 C 4 D 0 8 3 2 4 6 8 6 B 2 0 E C 9 C 5 F 1 6 E 6 2 7 3 B . e x e
C : \ 0 2 6 2 5 6 1 9 4 d 7 b 5 1 0 f 1 1 a 2 f 6 0 c 7 3 2 b 1 9 4 9 8 a 3 3 2 0 2 0 0 a c 3 a f f c 1 3 e 2 2 c 9 f 3 5 d c 1 2 4 5
C : \ P Z C C A g b t . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ n o t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ b e b 1 b 8 3 9 3 9 e 9 1 0 0 f 0 c c e c f d 4 8 3 6 c 1 0 7 2 8 7 4 c 6 3 5 5 9 6 8 1 0 2 b 6 b 6 4 8 3 2 2 5 e e a b c c 1 b
C : \ f f 1 1 4 5 d a 5 c d 2 d 5 4 6 e 4 e e c 4 8 6 8 8 b d d 4 2 3 c f 1 9 6 d 8 c 7 4 8 5 4 d 1 3 1 3 e a 8 a 8 e 7 a c e 5 0 3 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 3 6 8 e b 7 b 4 7 a 8 2 8 c d e e 2 2 f 5 9 8 7 0 9 8 5 d e 9 e f d a 3 1 4 0 f e d 6 c 0 5 2 7 d 1 7 d 7 3 6 8 5 b 3 3 3 3 b 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ j X B Q 1 n V s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 9 f N A N 3 N o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 3 6 6 c 4 a d f 4 3 b 5 6 d c 9 7 8 d 7 4 8 c b 0 0 2 0 7 e 7 a 0 3 d e 8 a 8 d f 0 8 d 6 5 a 2 1 7 6 a d 6 b b 0 2 3 c 1 8 a 1
C : \ e 8 6 5 7 e 6 2 8 f e 7 a f 3 c 3 7 6 0 8 7 b 9 e f e d c 3 e 1 6 1 e 6 1 d 2 8 a e 3 9 9 a 4 c e d 7 7 5 8 e b 1 d 7 b d 6 2 d
C : \ 7 1 a b c f 0 6 1 c a 4 a 7 e 5 f f 5 b 5 9 c 2 e 7 6 4 8 8 8 a e b e c 9 a b 5 8 2 3 c 5 4 d a 7 d 8 e f 0 4 b 7 9 f 8 d 7 2 5
C : \ a 6 5 6 5 c 0 1 3 0 c 1 3 f 5 e 2 0 9 4 3 5 b 0 9 2 7 6 c b b 0 f 2 9 2 2 f f 8 b d 6 c 6 2 a 6 8 7 2 a 0 1 1 a a 9 2 1 4 3 c d
C : \ 0 m S u E m c k . e x e
C : \ 2 3 d 2 1 2 9 5 1 3 0 c f f 2 7 2 5 3 9 1 3 1 c 5 e 8 6 d b 4 6 2 b a b 9 1 8 2 c 3 f d c 1 5 4 a 1 8 5 9 5 0 f 6 7 5 b d a 3 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ c 3 8 a 0 9 c d 6 9 c d f d d c d 4 5 b 5 b 0 8 7 e e 8 2 3 9 8 3 4 0 4 8 e 5 3 a 2 7 a 2 7 0 5 0 7 4 2 7 2 f 4 0 4 b 0 e d 7 1
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 d 4 9 8 0 9 0 4 c 9 9 b c f 1 4 3 4 d 6 a 4 2 5 3 d 6 2 0 a 4 8 a 7 7 3 a 1 b d b 7 5 c b 8 0 4 4 9 b b 3 a 0 4 3 8 b 1 f b c . e x e
C : \ 5 0 9 9 5 f d f 9 5 4 2 2 1 4 d 8 8 d 5 3 e 2 5 c 0 e 7 2 4 6 1 2 e 6 6 c e 1 b a 4 0 5 e e f 1 f e 9 b 0 a f a 9 1 6 d f 1 3 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ i Z i G k Q S C . e x e
C : \ 9 f 3 d 9 9 e a c 0 8 9 4 7 8 9 0 b d 6 4 3 b 1 7 b 1 2 7 3 3 3 b 3 2 f 3 7 4 1 e f 4 2 6 4 a 8 6 2 a 5 2 2 9 a f e 4 1 0 a 4 3
C : \ U s e r s \ L i s a \ D e s k t o p \ b 7 t E f S 4 y . e x e
C : \ Y 1 U 8 T F d C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ I x S N t n L 7 . e x e
C : \ 5 b f e 4 3 d 7 6 8 0 9 1 2 0 2 4 8 7 a c 7 0 9 d 7 e 0 5 8 e 4 3 4 2 4 c 2 9 d e 3 c 7 d 3 0 f 5 7 3 b e d 2 d 7 7 8 6 9 c 3 d
C : \ f d 3 b 5 e f c e d 7 d 1 f b 4 e b d 1 9 f 4 b a a 6 2 6 6 d 1 9 3 4 c 2 c 3 f 6 6 9 e 2 4 e 7 9 5 4 c 0 e 4 4 3 4 f 9 1 3 9 c
C : \ 2 9 4 b 7 2 a 8 d e a 8 4 9 d 5 9 8 9 6 8 2 b b a e c 0 c 5 3 1 3 7 b 3 d f c c c c 9 2 d 5 e 3 4 5 0 4 a b 1 9 9 8 4 7 b a 2 a
C : \ m 5 z 6 0 R X 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ e f 3 b 6 0 8 c 6 b 3 2 c 6 d 7 0 6 8 9 6 4 a 1 a 3 5 8 a 9 6 e 6 6 2 8 7 0 4 2 e 3 a 4 4 f e 9 b 1 5 4 c a 5 c c 4 1 a 2 f 9 7
C : \ 7 e 2 8 5 0 5 f 7 a 5 f 5 d 4 6 3 b 4 d 9 c 1 9 c 6 6 c 5 d 3 7 e b 2 a 3 5 5 e f 7 5 9 1 c c a 2 3 e 3 c c f 8 b 3 4 5 2 7 e 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 9 6 d 9 5 9 1 4 3 4 5 d 1 b 9 a f 7 4 a 6 f a 6 b e f 1 6 5 5 2 5 5 5 d 5 8 9 d 9 7 4 2 5 0 7 3 a b 1 a b 0 4 3 7 8 1 7 6 4 f 4
C : \ 3 e 8 4 8 4 9 0 d c f 2 d a f d 5 1 9 6 3 9 c b 2 e e c 7 d d 2 f e 0 6 7 e c e a 7 4 6 c 3 e 2 0 9 f 7 7 0 8 4 a a 9 2 e 8 4 7
C : \ d 4 7 a c c 6 7 3 2 1 a 8 d f 5 f f 4 a 8 d d 9 e d 7 5 2 4 7 6 5 3 1 b 7 3 f 6 0 9 0 a 2 d 6 3 0 9 9 5 5 7 6 6 1 a 5 b f f 7 2
C : \ B 4 Y F Y 6 B 6 . e x e
C : \ e 3 6 3 7 f 5 b e f 0 b d 1 9 a c 0 9 a c f 8 0 7 f 3 4 a 7 e d 3 7 f 9 2 2 b 8 9 e 1 6 3 a e d a 6 5 5 1 2 0 0 4 6 4 f 2 d 8 2
C : \ l A n m R u b r . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l M K u U g H v . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 3 2 7 9 e 5 d 9 5 0 9 a 4 4 f b d d 8 7 a 1 3 1 5 7 9 c 9 c 3 3 5 8 4 4 b f 8 f e 2 0 0 9 b b 0 5 b 5 a 3 9 b 1 a 8 e 4 3 1 1 c
C : \ 5 2 7 e 6 3 7 c 5 2 0 4 2 2 e d 6 b b a 5 3 3 b c f f 1 0 9 f 3 2 f a 0 5 9 3 8 d 1 b b e 2 2 9 e 7 2 f a 8 7 e b 3 f c b 7 f 6
C : \ 2 f 3 5 d c 2 9 c 1 0 7 4 1 a 2 1 3 4 a b d b 1 8 6 1 8 f f 2 2 b a 4 7 7 e 4 c a 2 b 4 e 1 1 1 2 0 5 6 7 8 5 6 f 3 0 f 4 c b e
Process Tree
-
008b3d6f5d215f683a6f7f0055c3591497a81082bb826965bee15ad9885158f1.exe (1848)
"C:\Users\Administrator\AppData\Local\Temp\008b3d6f5d215f683a6f7f0055c3591497a81082bb826965bee15ad9885158f1.exe"
- hhcbrnaff.exe (2064) "C:\Users\ADMINI~1\AppData\Local\Temp\hhcbrnaff.exe"
DNS
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49165 | 113.219.178.216 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49166 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49167 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49168 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49169 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49170 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49171 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49172 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49173 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49174 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49175 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49176 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49177 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49178 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49179 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49180 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49181 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49182 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49183 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49184 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49185 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49186 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49187 | 156.254.147.137 mokoshoponline.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | f25603679076e6c3_hhcbrnaff.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
| Size | 40.8KB |
| Processes | 1848 (008b3d6f5d215f683a6f7f0055c3591497a81082bb826965bee15ad9885158f1.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | 81c47b7e3a2e8933b48bea9d8fd62322 |
| SHA1 | 21bea767ad08f767e790a293205c4bc430b731a7 |
| SHA256 | f25603679076e6c3ef79ff7f1d6b9f12a43cfd6b579ad53f3da7c834f046a7b6 |
| CRC32 | D5BCE0F2 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4092410d42c4e778_94308059b57b3142e455b38a6eb92015 |
|---|---|
| Filepath | C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 |
| Size | 342.0B |
| Processes | 2064 (hhcbrnaff.exe) |
| Type | data |
| MD5 | 1106ca174e5478995d3297dd5ff92cc7 |
| SHA1 | 80bbb4e6d0a6516ebd65bb5aad44ba6c6cdff1a7 |
| SHA256 | 4092410d42c4e7783c9c1ae3be205595306ec6b8023871b0893d865db9901e55 |
| CRC32 | 75514DA4 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
|---|---|
| Size | 4.5KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 52adfff604af1d0434bbadc9c9859061 |
| SHA1 | 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
| SHA256 | f14074d4ec44eb3c708ff1fc4b07f459a396a87542112d80e5cd268304abe580 |
| CRC32 | BAEF690E |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |