hxxp://cando--china[.]net

General

Target

http://cando--china.net
Sample

210504-dmkcn4qyns

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

4HwMTLRFvpnRf2a.exe

pid process

3456 4HwMTLRFvpnRf2a.exe

pid	process
3456	4HwMTLRFvpnRf2a.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead5207ab2cd701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000483c891c99e4be58973116ced4877c56b69ff0eb80ca9c6e43a72f83b0599445000000000e800000000200002000000081389ba8194a085b19a9ae5a9fea535f3a547459e6ea368b860ba6206dd8c9f1a000000034512706e1a11aa418f94771d933d22f78378e55f916f9afe91539808c79afd763285a9a55c8f1548b82fa881e943795f18a236547123e79a9afc4ea2dbdcc880593ed5cdfacc6b0a7c049550fe3b74b894885680452cd27791a2cd31ddddd48b38346045d66a400e43f86fdc1076fcd82352c3b82c3edfc3042c46d6e409cec270862523c4716c7381cccff4d71e9754ad17cbc582afd3dc0ddc726074da6ed400000003a16251882c1accb62e50b3dfdc1b863627bc7643ed398e990d80ebe273be1bef1050769d96d2509a8c0560af208d6833423031d39cadbe7d7542cf410fa8e23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884098"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000004a3e4256e92a58d97ea7c179ed8029eb0b5475dba620a434383705a902e6ad27000000000e80000000020000200000001e78908bae7fa114d54db2b206c19900a0ea1e4b3a268adf39469c9d35f23b2ca0000000df5d71b9b32fecda96baab6b0f0148e7b062975de8a90b82109f03e46be1ae930b06a2f35ea16f6b6c67a65dc1f5e61be7514c1fc7594ed08d7aaac55ad0b353e9ff5322da800ebcfaa2c4a3623e333ed5b009f96b8f1a796a800cdc2bf9027eab8d81467203017e2620b38c07568a2271e348698a83fe32eb3fb40b3efd121bee01bab58fdf0380876c95511598d76511840fded7cc86210e7ae54b538b5006400000000c49e69d0112f5f9459b90cb8323d42efa9fbea7c103376376d2b99448f2f063d5d4e514a80accddaa2307d8de2130c6b6263083bde485fcff60f05c0a6ab295	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "326959372"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000005f7832841b1228a99a97b5f065ce9667b822ed580fabcfc2cb3a5e2d481c2819000000000e80000000020000200000008d0158791c8f3b41cf937a4fe271d88b78f8e5b711577cab24c6cc09d4147efb200000004b0e515059c9d5f18166c99156135e7a06ebd27d50908439946b9a1c4a2e4ebe400000001a5dda48eb899ca75103fd5198be5183796047cc9a8b6aa5194415a91ece5e6fbb19d178d3a1e0446b34c180478de14816831b2e8284d35380f51a82dea2ae38	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03f61ca0241d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{E986A6E9-6BDB-4FA2-9624-D056D5C1C414}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "326910787"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC0115F9-ACF5-11EB-B2DB-FE963E078230} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701f62c90241d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000d5e229f7a6dbc0bd36dff47f03657206e72d5d52797a8e9106f8e644c58cff86000000000e8000000002000020000000f00d5346c5be96dca7e2c6db704cfc4f7848b52bad94ab2d365f32a02d785582200000000778928a3499744ecee6a8f4b6e382755f09c5bdb6fb485e9216ab3a05574857400000009bbe11d52f1d3acff46ab5f7154206e0bba995be36ef495d4b029c8649d5e8eb2ff706063d9d77c69c27a717ecc947abb1241e3df916da7cfe4778e244bf86e1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3570586933"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3522716289"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3522716289"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30884098"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884098"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "326927381"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

800 iexplore.exe
800 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

800 iexplore.exe
800 iexplore.exe
3276 IEXPLORE.EXE
3276 IEXPLORE.EXE
3276 IEXPLORE.EXE
3276 IEXPLORE.EXE

pid	process
800	iexplore.exe
800	iexplore.exe

pid	process
800	iexplore.exe
800	iexplore.exe
3276	IEXPLORE.EXE
3276	IEXPLORE.EXE
3276	IEXPLORE.EXE
3276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 800 wrote to memory of 3276	800	iexplore.exe	IEXPLORE.EXE
PID 800 wrote to memory of 3276	800	iexplore.exe	IEXPLORE.EXE
PID 800 wrote to memory of 3276	800	iexplore.exe	IEXPLORE.EXE
PID 800 wrote to memory of 3456	800	iexplore.exe	4HwMTLRFvpnRf2a.exe
PID 800 wrote to memory of 3456	800	iexplore.exe	4HwMTLRFvpnRf2a.exe
PID 800 wrote to memory of 3456	800	iexplore.exe	4HwMTLRFvpnRf2a.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://cando--china.net
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\4HwMTLRFvpnRf2a.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\4HwMTLRFvpnRf2a.exe"
2⤵
- Executes dropped EXE
PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
10987a1d727697d22e9613985bf39eba

SHA1
d92fa559cdea14bdc068eb5388f4a8725d9d290c

SHA256
8c026af272e0d8eae1ec8978047926e4bbdb2a7ebe0207a738307150e2ed0063

SHA512
31910362ff1a6afe47a6abe7d77d1056eb1a1531cc027ae33bb34e1b4b788cd7efe2292278b02548e72b1441c86f85a3376ed46edf4c58a247febf4da91dfb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
fbaec4ab0631e878b4e14258bd189495

SHA1
82781543099992fd8183304723f0b3599debbe9f

SHA256
c4698d1c3d5c5806a9a42e4816dde887c42a8ad5ac936b4cbd14ba107f9efc8c

SHA512
1950ddcb82a7f9ab71b5cf15fe311ba3112ee8bf676a2f22de570a67c826ccec8ccdc01120395539d162b69d16c991d6073a8d6ef6913f4c6bcb6a47048ff682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\4HwMTLRFvpnRf2a.exe
MD5
ec835ba0c96c625b726e90871fa4408e

SHA1
f4f79d8c5d99dd6435f72bcf9c1d90aab96e47ab

SHA256
6a156918ff4ace56113e28bfc878aab413d3021fc89f0e6dad59744ac25874fe

SHA512
eb40160fc4e8911920e8f0537c38d665eaa644b3d48159e8143b0e6cae076ca3c81aab59c28e3440c052280d5664798db37399e4855a5c82649f0a4c8fd1ee6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\4HwMTLRFvpnRf2a.exe.pf4f47g.partial
MD5
ec835ba0c96c625b726e90871fa4408e

SHA1
f4f79d8c5d99dd6435f72bcf9c1d90aab96e47ab

SHA256
6a156918ff4ace56113e28bfc878aab413d3021fc89f0e6dad59744ac25874fe

SHA512
eb40160fc4e8911920e8f0537c38d665eaa644b3d48159e8143b0e6cae076ca3c81aab59c28e3440c052280d5664798db37399e4855a5c82649f0a4c8fd1ee6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\218UGETV.cookie
MD5
945cc773e9eb59f4df488cf76a3d5453

SHA1
06ff5c4225edc8ba9f512dc12e4a2a26d62eac03

SHA256
dc28403422a26115ebcb1f8cf30d7832d17f3f7d316631e7ff7bac541a3a6c85

SHA512
23ae0086aa86875b95a95c0c2bed55d9bd348d59e2526eca7f32e010713d2c1dc239665da9cf4d080b87d78441e9ff4130d1e4149ba6fe1aecfa52b597c98ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2D0WXPKT.cookie
MD5
ac40d716001eb28707e8ad8f80263675

SHA1
49e77c6368266ceaeb1b3cce4bef5b60dc6633da

SHA256
19f9fc90a7e7c27a60f75adfa83dd82ea945b684862afc539410ec23503d3ae5

SHA512
70e7ed7ce4e32cea24a9c9253d309d4febc8e454489cea34fe1ccc499394aa81262806ca77d1444f62aa0f1ec950a61468110809efe8702bbb3e23793005db11

Download Submit
memory/800-114-0x00007FFBAF470000-0x00007FFBAF4DB000-memory.dmp

Filesize
428KB

Download
memory/3276-115-0x0000000000000000-mapping.dmp

Download
memory/3456-123-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/3456-124-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/3456-125-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3456-126-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/3456-127-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3456-128-0x0000000005510000-0x0000000005A0E000-memory.dmp

Filesize
5.0MB

Download
memory/3456-129-0x0000000005760000-0x000000000576E000-memory.dmp

Filesize
56KB

Download
memory/3456-121-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/3456-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads