Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 18:22
Behavioral task
behavioral1
Sample
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
-
Size
38KB
-
MD5
107a2e943ec481afc191f95abec83287
-
SHA1
2f3f05d1bf53272313bdefa0707383bef715dc00
-
SHA256
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1
-
SHA512
60365d8db2797c6489d2ac1bef7347d13fa000b7eb84b8e864bcb69d92ab01c7b1993bdcfbba2667d345b16faa61dc57b3b15c5a23bb982bb136cda74bf25c3d
-
SSDEEP
384:/T/bkPtmZGS4xR+cXFQ0NYMXjnfdWrd+h/WNbbsxrvPVFEh7:/vEtmpiQ4YMzfdidDJgR/E9
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/860-57-0x0000000000400000-0x000000000040B000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000028297cbefebb6b271d1ef91d2763c6c82a47ad78c3aa384b16d111d69a934ccf000000000e80000000020000200000005acef20a90b27d43044d0cac84d3355c06a28b81292869fa5d765caa1797ddaf900000004a8e1d87ed4cbe5810624a258f315f5b33bcd34f27f173c47e1cfe231e5a638771c16153043011e1e7f2b4d2601946c6afe9a61b3db964deb75c29a08b3075a69ad8a95b06ab0e12a5b02249d59e09eb711f9ab3370a9dac49c69aa70dfecc81c065d378a018b071036f6538e9133fe3458b52784cb768d86ed84a3164c35601b9be45b0a2fdc248f3f1aeddeb6a144f40000000ee2d7673ce066ba13eebfa700d1a569e8fae1063e68f0e82da8159352cb786db3d9709bf14b7f4a835acaea40535d5d99083845f9700055df459a2d9c3a95ae6 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01f0abeaeccd801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF5FB921-38A1-11ED-B25A-FE72C9E2D9C9} = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370415315" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF5C84D1-38A1-11ED-B25A-FE72C9E2D9C9} = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1372 IEXPLORE.exe 288 IEXPLORE.exe 272 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 1372 IEXPLORE.exe 1372 IEXPLORE.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 288 IEXPLORE.exe 288 IEXPLORE.exe 272 IEXPLORE.exe 272 IEXPLORE.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 860 wrote to memory of 1372 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 27 PID 860 wrote to memory of 1372 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 27 PID 860 wrote to memory of 1372 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 27 PID 860 wrote to memory of 1372 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 27 PID 1372 wrote to memory of 1836 1372 IEXPLORE.exe 29 PID 1372 wrote to memory of 1836 1372 IEXPLORE.exe 29 PID 1372 wrote to memory of 1836 1372 IEXPLORE.exe 29 PID 1372 wrote to memory of 1836 1372 IEXPLORE.exe 29 PID 860 wrote to memory of 288 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 30 PID 860 wrote to memory of 288 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 30 PID 860 wrote to memory of 288 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 30 PID 860 wrote to memory of 288 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 30 PID 860 wrote to memory of 272 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 31 PID 860 wrote to memory of 272 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 31 PID 860 wrote to memory of 272 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 31 PID 860 wrote to memory of 272 860 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 31 PID 288 wrote to memory of 1624 288 IEXPLORE.exe 32 PID 288 wrote to memory of 1624 288 IEXPLORE.exe 32 PID 288 wrote to memory of 1624 288 IEXPLORE.exe 32 PID 288 wrote to memory of 1624 288 IEXPLORE.exe 32 PID 272 wrote to memory of 1940 272 IEXPLORE.exe 33 PID 272 wrote to memory of 1940 272 IEXPLORE.exe 33 PID 272 wrote to memory of 1940 272 IEXPLORE.exe 33 PID 272 wrote to memory of 1940 272 IEXPLORE.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe"C:\Users\Admin\AppData\Local\Temp\d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/Loader_jieku_977.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/haozip_tiny.200629.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:272 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DF5C84D1-38A1-11ED-B25A-FE72C9E2D9C9}.dat
Filesize5KB
MD5064bba61ea2597b4f30138a94b9f0e41
SHA1e868e222b2f60e055285282b93d2e2145166c17d
SHA256560ffe1dd13e6258dc99ad11c6ff71dd8dbb71c9abdff4a4c9c1983b056c9416
SHA512b3fb7ba70c3a5cb2589da80bbf9c0de96c4bc6efc9827fa2cee12852085d217d2d49bd3ae634e69f7206b94040a9b9e5ddf12202b1dad1e4bfc9ac708222fde2
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DF5FB921-38A1-11ED-B25A-FE72C9E2D9C9}.dat
Filesize4KB
MD50bab2d26f8556dd883f6d0423f4f3984
SHA17d13e7c3b3a77d7c6fb3328b9af820e6f9c9c521
SHA256acbd4e38a9169bf5fe221409637c454651d43dd02274db9dc28224679d9e14bb
SHA512699866c6f3e12fda5c3c6d747c9614a1261e06de8bc05e179f4b7e22cc1e89973db141b6ab2f8096e73b20ae085a075bb7920248055e4d535a8f4115f5b98839
-
Filesize
608B
MD56be1ccd443e54a73ef1e802622860556
SHA15a7f498a6233742885282216f6bea78a15548af8
SHA256c8cd6791ab0368b233d7c89d73972e3a1232a549d6c1790478989f560dd99a2e
SHA512ee6a0956823ef1f22d3a2aad291463b659f4c77e555a5168ca744bcbdb7bdd8eb7e8e31f1bb135f1a955224d6952d9e072a89c71f764ee49758a048ac6695919