Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 05:17
Behavioral task
behavioral1
Sample
5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe
-
Size
10KB
-
MD5
5e746b7306ca5efc79778d31ef45787e
-
SHA1
ed82d4e9233bb94b168739affa60c13022183e5b
-
SHA256
5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85
-
SHA512
c21dfed9eb427185e6f1daf72cf9f03f88ea76e00732d868ab7dfbd556a63a5b7484e7adcbb6f8a9ea1c09b80a2c2f370c6ebb6768d12a951cb9ebff120899ab
-
SSDEEP
192:/TWcs7jN0zdQOgB6trUtQyHn6nBFNpc2isD9JYAUDiqSsQV3E/q:/T5AezOOgBvHn6nBtssD9JYliLVV3E/q
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1720-56-0x0000000000400000-0x000000000040B000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FBC7BF1-37EA-11ED-979A-4A7553B9BC92} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370336423" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002b0c8387ff54957df584283bbd68da8e1fbb4f464281a3086a6ba4ad6f8acf71000000000e800000000200002000000095e454217d5f7aca6a2e0d88943a93cba4e129254b3afbd1e7513cea027a102c20000000eb94e9127e8b4f0705492e4af725c53c92d1fbe8ce042f18be7ca444d067a67440000000c7d09768eff23f423f83415235f908b6e87ab9f50e01642607014f53ecd2e762fa9562521b907e1c24690ace202728709bfa2098a9edb7e177aac9135b927435 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50507b0ff7cbd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000001f6d8a78d9b94b96105e42817ffc5906419d5a2d7841dfe8247d8963d4d2fc96000000000e800000000200002000000014bf2b24936d8ef8a415fa19f135a8b78ab2ada02f006aaf9fa8badf2205e3ce900000009df2ccc85f245b64efe42cce3f167c916893f8145032db34bbb815302458d207b75117c03dc86a745a2d5280e0a506af057fcc7b134d4d60ffb9583a1d9996a1ad0035b961b236ed4aabb62510edab51bdc74b8c14d5197790fe2c4971b353a2480cdf434f4e9120207064987038b48d5d9f18a97f384f42d5189c4e3a62f0fca2deaf644f31182c42a2fef472469fba400000006cc66a25676d99a5f5e3ee2ad692fdbf758bc816fb69350a13d37f805d4dbffe762b2bbe1302e6794a2631755d5bd3d43df54c18535796381874cc5d4fc112e7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1720 5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe 2012 iexplore.exe 2012 iexplore.exe 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2012 1720 5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe 27 PID 1720 wrote to memory of 2012 1720 5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe 27 PID 1720 wrote to memory of 2012 1720 5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe 27 PID 1720 wrote to memory of 2012 1720 5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe 27 PID 2012 wrote to memory of 1516 2012 iexplore.exe 29 PID 2012 wrote to memory of 1516 2012 iexplore.exe 29 PID 2012 wrote to memory of 1516 2012 iexplore.exe 29 PID 2012 wrote to memory of 1516 2012 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe"C:\Users\Admin\AppData\Local\Temp\5c6ae192b759df8f2c3c9b5238f4d2eacfa1a3eed1f628cd347858026b8c5a85.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1516
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603B
MD5693c4e7711b0af14b4392ffde9fd1630
SHA19395ccc219a3dbd411fce8c6f48cf8e4cdc22e32
SHA256a4f4467d187b97a870b3fd2c52558f6625cc20fd645b5cedd63cd9d3bfdd96e3
SHA512a796e8d3f4be807f6d5d6fe2a1b98dbd0b8780f92bac0f2cc4aee12e5aac9c0314328cbb69567b0d6583e5b94231881cbc3e50148cbe42262fd768114bab5ab9