Overview
overview
8Static
static
grldrinst.exe
windows7_x64
1grldrinst.exe
windows10-2004_x64
1grubinstGui2.exe
windows7_x64
8grubinstGui2.exe
windows10-2004_x64
8msvbvm60.dll
windows7_x64
1msvbvm60.dll
windows10-2004_x64
1mtldrinst.exe
windows7_x64
1mtldrinst.exe
windows10-2004_x64
1myvolume.dll
windows7_x64
3myvolume.dll
windows10-2004_x64
3下载说明.htm
windows7_x64
1下载说明.htm
windows10-2004_x64
1使用帮...).url
windows7_x64
1使用帮...).url
windows10-2004_x64
1欢迎来...t2.doc
windows7_x64
4欢迎来...t2.doc
windows10-2004_x64
1Analysis
-
max time kernel
94s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:30
Static task
static1
Behavioral task
behavioral1
Sample
grldrinst.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
grldrinst.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
grubinstGui2.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
grubinstGui2.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
msvbvm60.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
msvbvm60.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
mtldrinst.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
mtldrinst.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
myvolume.dll
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
myvolume.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
下载说明.htm
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
下载说明.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
使用帮助(河东软件园).url
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
使用帮助(河东软件园).url
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
欢迎来到 grubinst2.doc
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
欢迎来到 grubinst2.doc
Resource
win10v2004-20220414-en
General
-
Target
下载说明.htm
-
Size
3KB
-
MD5
9bd1ac9ead8eda95e8284f12ddba89e2
-
SHA1
44ad2b426711da0bc122d500b9117808385bd406
-
SHA256
54198ae94a082537ca82686954de11084ebb050917b65871fe1639c2c1a308b8
-
SHA512
e94611639a7396705f684055fa762db261bbaffb2d7b459b1fddbd44d25358b3bb3111ae84a8bc444388f26908193fbfa79c232570f52a38f1c49fb57b322850
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960663" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30960663" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359794888" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "291938921" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "400977953" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960663" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043099a93b0a2dd41b22bfbb30670caee000000000200000000001066000000010000200000004db497388539ea2cc468ed679df6772059077cca2eaba7c7c4362a28cb809d30000000000e8000000002000020000000cbd9d3506a3511832a2a8059f2ab0f9862acb963f75d877089476be1a9f50a99200000009d580d936d59cf525329ccc0d7bdef2d2d018f1129f530d9aaa1710ddf5097424000000026d61d890279029440376f18140b384927b0161811ef9b237e4ebb084db9f08633a1483be42206c64d6c51acd84d3b0e11b5132a6214611b16749af81cc46fec iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3AD3F51A-D80A-11EC-A58B-E2E53B72FDDE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "291938921" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900b0318176cd801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1448 iexplore.exe 1448 iexplore.exe 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1448 wrote to memory of 4816 1448 iexplore.exe IEXPLORE.EXE PID 1448 wrote to memory of 4816 1448 iexplore.exe IEXPLORE.EXE PID 1448 wrote to memory of 4816 1448 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\下载说明.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5003a496cfd41526dddbe8b00273a047f
SHA1f59d563a2a66fe14a3f7787a00e96359aedb5ab8
SHA256c7a19cd00fd53275f30a71c8f5d87161e5caff68207f4069079ea1448a9ebf41
SHA512e4601d093066d6b28e0d99057218f7fb2501fcf24d59b46e0b7babcd24408f4cf0739873b5e74580d6b7a49df6af5ddcc241875ab4633a872a2262b7e7e0b191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5bde3ed737a93f5fe2b54cc3933c91846
SHA1bcf78d7cdd2a900d53451acbd9ef76f33fdcad9e
SHA256fa289bf2da2cb21a819a698ebc9d3ac786baef5c3c4738af1e54477f1630d377
SHA512e56921dd7449de599031f9f8d096b78b915e7d4a108cc02192ed6b9feb8112d0513522a46a3a5f81720427dad15100d1da95c75ba6642199fa80b2111a387003
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\a5473fd\imagestore.datFilesize
5KB
MD55a7c35e5d8e2ee9c054540c0a0690aa6
SHA1d2a1bc1b9a59abce7d58ef3ed57ca6d186b7a49a
SHA2568909d9a4204955178e4275395a7d11245dd32e59a88f18f92f2b6e9873dcd236
SHA512b7939cea4529e977c13807237403f74fbef89778acb8240c766316566d67bbc743f5f55c940e8b449be3e338299060180919a86614a5384cd90039f708cf4709
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RCUAB8WT\favicon[1].icoFilesize
9KB
MD52e66dfa5202e20ab5384d13ff0767feb
SHA1279c1657c9916a32f467c6023e69f18dbe67f7de
SHA256b173eededb8f7a4e0b00c95e66f757418882ee794d148fed6178c46af701cab2
SHA5128d20ae5c1c2b267c5f5da6eb96255e92db03f89428123a6cd64ec5bafb209b671adc5a2cf87068c4b6d4516fc41faa2779b8620540b1ac75b087705603da3fe5