hxxp://cando--china[.]net

General

Target

http://cando--china.net
Sample

210504-l9prtg9dss

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Ll2LxWOagynlSgJ.exekrNzUd2Snww9hFP.exe

pid process

4040 Ll2LxWOagynlSgJ.exe
1048 krNzUd2Snww9hFP.exe

pid	process
4040	Ll2LxWOagynlSgJ.exe
1048	krNzUd2Snww9hFP.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead5207ab2cd701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884118"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003ec62a1641d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30884118"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "690305886"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "326919089"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "657336501"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa0000000002000000000010660000000100002000000000897ed5ef3d4202cb1c0cd5b2914c6c7e7112db9d827803d53acbe43bbb9436000000000e800000000200002000000037527d325111e9728917ee8142fe78f0640e0d6b8d1214d4d8271b77ca5d091520000000272455dbcc434695df17bfa3a3dccc19e0abe05a3490c3b1475bbc61a1c56e9640000000a11945c0b0e4062b82a27161c700782eae9a67bfa7a8025f4d0a4f21206e3e6cc9490f98b9f2fc0e55392b53f92737aee620068bddda0dfeb53849652fc5b39c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "326967674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{73278A87-305B-4522-9823-62EE7A8CD9EA}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000b0355ceefbf9a55e5204188986d2e3b1f8c4b69595b6449685107649b65cb667000000000e800000000200002000000036bb484b5eeec3f167e0942f6c2497b603d2a79cb0563fb9e7a4f780dad0fad720000000693b8b32e28251f1e919ecf37261b730098f1383f87b2861948ef4024aed52ff40000000f15dcf3a8ea9d946f9efce90e783930a904b33ddea0353624ae085eae0df6a368295fa4a68f11033a23df94bd9dc4ff9df083c90605199cf25d8365906f87dd6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "326935682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "657336501"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52039657-AD09-11EB-B2DB-C6A62EEC4D20} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5044a72a1641d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe

pid process

2840 iexplore.exe
2840 iexplore.exe
2840 iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXELl2LxWOagynlSgJ.exe

pid	process
2840	iexplore.exe
2840	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
4040	Ll2LxWOagynlSgJ.exe
4040	Ll2LxWOagynlSgJ.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2840 wrote to memory of 3032	2840	iexplore.exe	IEXPLORE.EXE
PID 2840 wrote to memory of 3032	2840	iexplore.exe	IEXPLORE.EXE
PID 2840 wrote to memory of 3032	2840	iexplore.exe	IEXPLORE.EXE
PID 2840 wrote to memory of 4040	2840	iexplore.exe	Ll2LxWOagynlSgJ.exe
PID 2840 wrote to memory of 4040	2840	iexplore.exe	Ll2LxWOagynlSgJ.exe
PID 2840 wrote to memory of 4040	2840	iexplore.exe	Ll2LxWOagynlSgJ.exe
PID 2840 wrote to memory of 1048	2840	iexplore.exe	krNzUd2Snww9hFP.exe
PID 2840 wrote to memory of 1048	2840	iexplore.exe	krNzUd2Snww9hFP.exe
PID 2840 wrote to memory of 1048	2840	iexplore.exe	krNzUd2Snww9hFP.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://cando--china.net
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\Ll2LxWOagynlSgJ.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\Ll2LxWOagynlSgJ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4040

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\krNzUd2Snww9hFP.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\krNzUd2Snww9hFP.exe"
2⤵
- Executes dropped EXE
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
10987a1d727697d22e9613985bf39eba

SHA1
d92fa559cdea14bdc068eb5388f4a8725d9d290c

SHA256
8c026af272e0d8eae1ec8978047926e4bbdb2a7ebe0207a738307150e2ed0063

SHA512
31910362ff1a6afe47a6abe7d77d1056eb1a1531cc027ae33bb34e1b4b788cd7efe2292278b02548e72b1441c86f85a3376ed46edf4c58a247febf4da91dfb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
9793b773c8baadb03958ede6d849ed62

SHA1
2f286938eaf13f450c5e3e083990c3621e5a5457

SHA256
a120aac7542deed3d806ef641e9e41263e917b927212d208321ea2ab0ec76bd3

SHA512
ad5f5608b045f302902f728ffe1a07d708f515f086bd5ff3b0b34d9221797607dfea21402aeed3c0e6148047999496c4bd63f1e488fa876bb0f9722b7ed8839d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\krNzUd2Snww9hFP.exe
MD5
3a52a950c96af984283d291589a1fe9f

SHA1
20234a4769aaf89b4dabe49b29b384a5511126c8

SHA256
08ba87961ea2938d658c3079b06833833e672b942a609459a21e1a6a64c5e288

SHA512
ee9da0ac9feb6878ab7ed51f705cb64571d74fcb7d3bd1f5f473f5fdf1a1bc9a3028e9e1fd5d1c20e7720aaa34c7f529efc8222f632003f6c3eab4283fbe7611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\krNzUd2Snww9hFP.exe.21jez6a.partial
MD5
3a52a950c96af984283d291589a1fe9f

SHA1
20234a4769aaf89b4dabe49b29b384a5511126c8

SHA256
08ba87961ea2938d658c3079b06833833e672b942a609459a21e1a6a64c5e288

SHA512
ee9da0ac9feb6878ab7ed51f705cb64571d74fcb7d3bd1f5f473f5fdf1a1bc9a3028e9e1fd5d1c20e7720aaa34c7f529efc8222f632003f6c3eab4283fbe7611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\Ll2LxWOagynlSgJ.exe
MD5
9dfaa6afc47f0bf01155b7f8253f719b

SHA1
0e82d1395e219ed0400959e6315675fdd03f0a54

SHA256
fd0be553157fca2a0a5f4cc559d95a3d6ec4b27b6f1368cad25997cac0ccac8f

SHA512
95f379a10ffd895be1b653dfb32227be31764c13ce75f35f21be6472045e385bb0aca718a6a1b0c57158c1449094b409c3192f19c47900e2d3829588b9980e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\Ll2LxWOagynlSgJ.exe.548ai6h.partial
MD5
9dfaa6afc47f0bf01155b7f8253f719b

SHA1
0e82d1395e219ed0400959e6315675fdd03f0a54

SHA256
fd0be553157fca2a0a5f4cc559d95a3d6ec4b27b6f1368cad25997cac0ccac8f

SHA512
95f379a10ffd895be1b653dfb32227be31764c13ce75f35f21be6472045e385bb0aca718a6a1b0c57158c1449094b409c3192f19c47900e2d3829588b9980e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WH8FNLDX.cookie
MD5
345da1654a5b502835fe15f016498c00

SHA1
3ba52f17d89dece330f311fad7650f9cefe10123

SHA256
6517081b6ea0be77cc56d0411b6947c4fce5d575c215fff3581f1f358cf5e0ce

SHA512
7187407325e66a66e40ae289ca45995f88b464b06ddefc8558730dde6b501e8df8dfe55d83b0d2ec05b84dcabeb6582484e2a033b6f87d97953b34e63836f3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Z0SV5TCE.cookie
MD5
2c8265649bff07ae3f4b58197fa69ad3

SHA1
83486c1c90e54579e93c7a77816ca81ab9749c46

SHA256
d18feb618601527cc456803ac9f8fd50a28608d57bb94024ea60e1269d28f4f7

SHA512
499e7de3fc0fba53368daaba0ceccee92f55b9551067616dab23d83632b18717f1dcf196d8a76b732729d6e64c048bc261c107649d50310cc1dbf48e5de07a0f

Download Submit
memory/1048-145-0x0000000005440000-0x000000000593E000-memory.dmp

Filesize
5.0MB

Download
memory/1048-137-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/1048-135-0x0000000000000000-mapping.dmp

Download
memory/2840-114-0x00007FFFED310000-0x00007FFFED37B000-memory.dmp

Filesize
428KB

Download
memory/3032-115-0x0000000000000000-mapping.dmp

Download
memory/4040-130-0x0000000004D00000-0x00000000051FE000-memory.dmp

Filesize
5.0MB

Download
memory/4040-129-0x0000000004D00000-0x00000000051FE000-memory.dmp

Filesize
5.0MB

Download
memory/4040-121-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/4040-131-0x00000000051F0000-0x00000000051FE000-memory.dmp

Filesize
56KB

Download
memory/4040-128-0x0000000004D00000-0x00000000051FE000-memory.dmp

Filesize
5.0MB

Download
memory/4040-127-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/4040-119-0x0000000000000000-mapping.dmp

Download
memory/4040-126-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/4040-125-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/4040-124-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/4040-123-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads