0763d75a0d97c936c66de516b2b8c6a34281bb4599a613c0691109b15247685e

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

练习参考程序/练习3/VS2017/Ope/Ope.xml
Size

10KB
MD5

be68f8cc59a3d42b7a950d3cd2b9f8d9
SHA1

dbaa1030b90f4961f173dc4f3493f5d124a9481f
SHA256

9e08cf5b881db41d8e1a9e48bf9d7299c056d6ff4e770fc19d706c32576a8abf
SHA512

264e7ec5c0bc62bebbc040a3cd88d4952c085f6fdb7648b27560e09956975d59b5be39dd42288cdaf276cf1f09b95d701dddfa097ad32a12b2bf5df26668ddc4
SSDEEP

192:yx/zcTh/RBkRbn/UfH/sfD/zfe/rfCi7k:yp4T4/UfH/sfD/zfe/rfCi7k

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1616815894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1628691680"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8BB4CAFB-3FD5-11ED-B696-DA88DC7FA106} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00195862e2d3d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371207168"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000027748a6eb4bd07bffe04993bcc169adee95b2a7c9e92d5840bd5ae948c76ee46000000000e80000000020000200000004a2a3333c06f0f079852e2f8987b56eeb96d8bcb55c5c40cc1d82471f3cae398200000002fc874d21c7a6cb2a7edca388a8fd011ababbcd323df88230a988a0f9d6d830f40000000942399a965e13c1ba7af396cb95369003436cc547652fe9802f43f2058b89d75f00bbb71e223b285f69909e84cb945f63a8c143b6b8183c4e597cac850ec07b4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987234"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000002c2b2adf0e15b3f79c878819333efe750e58a554afca09e9b024ad847b50e404000000000e8000000002000020000000536c418ff2761aeebc57ef5ed75cd04557f2bf2217310aaab9354cb099816afe20000000706ca690002ec643ea2188d2180c3b69d8221fe7f25cbaf109cb7ead26fd624940000000f44da05d61cb796c37d8d966e4916f06a348a5c970c145a735318bbfb80fc7dba56e87871b8dd60e2975212ff05f5aad5badff387547fd147df14be2dbedf113	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1616815894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987234"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08e6162e2d3d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4160	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4160	iexplore.exe
4160	iexplore.exe
4928	IEXPLORE.EXE
4928	IEXPLORE.EXE
4928	IEXPLORE.EXE
4928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4160	4860	MSOXMLED.EXE	79
PID 4860 wrote to memory of 4160	4860	MSOXMLED.EXE	79
PID 4160 wrote to memory of 4928	4160	iexplore.exe	81
PID 4160 wrote to memory of 4928	4160	iexplore.exe	81
PID 4160 wrote to memory of 4928	4160	iexplore.exe	81

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\练习参考程序\练习3\VS2017\Ope\Ope.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\练习参考程序\练习3\VS2017\Ope\Ope.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4160 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
6e49f7f1e7d5faf70613dcb484cc70e4

SHA1
b17a7107140658a4cab09549a23c78481a299026

SHA256
038c08b412582a9f36e5eb1f65c5786f84e5239f26e7534c790a777265657142

SHA512
98c3a2cac5680aa57680405185be9bcfb38ebc417007e0a911044b1b5aee96336c40eaac0c7a308cb2b3e3e2e3a37c3cdc685f998e2a99f40978588cee8f3fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
69983eb871c0f79300c548fd569769d2

SHA1
8e3f41db587061b0723a330060d61bc6105b98cf

SHA256
3fcf4578f345a531d8c94e1be46e9060568237b4637bbf3580d09793f0f4634e

SHA512
09caf871a5e3edb711449458f54feed5046f5871028ee82b290c559f045fcfd3c999069031f3bd0cafa0521de4ad8439a0ffb3b8a5d906a73feb6c0f9016f38c

Download Submit
memory/4860-133-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-132-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-134-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-136-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-135-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-137-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-138-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-139-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/4860-140-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download