14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f

Analysis

max time kernel
140s
max time network
167s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
Size

2.7MB
MD5

6c9722cc71776d80f2c50816efdbe85e
SHA1

d73636f93548e96fda42ca820461c1352414412b
SHA256

14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f
SHA512

bdb1579768276fb03cde0a5e33eea7a4c009bc96f59dd656fc0f2c59ca40030b8df92555fbdb6cc03eeaa5e3343699ecedd7419ef8b81151706f112d4cb5d2a8
SSDEEP

49152:6ffy4NwrQq6Y0uaXxl9LC2v2UZGglxh5ozMP4NQQOSr5k/I4XTZGfDahGGrgQ:6ffyH69uM9LCC2UfYz24NQdWC/IgT9VX

Score

10^/10

bootkit persistence phishing upx

Malware Config

Signatures

Detected phishing page
phishing
Executes dropped EXE 4 IoCs

Processes:

86on_yes.exehahagame.exeSeFastInstall3_3261.exehahagame.tmp

pid process

644 86on_yes.exe
1732 hahagame.exe
1204 SeFastInstall3_3261.exe
1496 hahagame.tmp

pid	process
644	86on_yes.exe
1732	hahagame.exe
1204	SeFastInstall3_3261.exe
1496	hahagame.tmp

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\SeFastInstall3_3261.exe	upx
C:\SeFastInstall3_3261.exe	upx
behavioral1/memory/1204-68-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral1/memory/1204-82-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

hahagame.exehahagame.tmp

pid process

1732 hahagame.exe
1496 hahagame.tmp
1496 hahagame.tmp
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

SeFastInstall3_3261.exe

description ioc process

File opened for modification \??\PhysicalDrive0 SeFastInstall3_3261.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1732	hahagame.exe
1496	hahagame.tmp
1496	hahagame.tmp

description	ioc	process
File opened for modification	\??\PhysicalDrive0	SeFastInstall3_3261.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "185"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "94"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371528959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "514"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\webpage.qidian.qq.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "628"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn\Total = "185"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "199"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com\Total = "77"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C65F4371-42C2-11ED-A20B-4279513DF160} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "270"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\webpage.qidian.qq.com\ = "69"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "708"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "60"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "279"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201a23aecfd6d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com\Total = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliyun.com\Total = "74"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "462"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn\Total = "217"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "339"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "628"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "245"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn\Total = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "287"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "455"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000097ea138785239cef868cb73a98ffcbee1df5d62ca388395bd5837b9bb7d04ebe000000000e80000000020000200000005cc25e66dc7511f9fe8629140553d8f2fed1fca218e98b7dc70fcead9f429efb200000003ff546228ead655c191af45d9bcdedf5ad93463bdae2227d4f50d2489d6ad8d840000000ce0cf403cddaf7295999a4d5970ddcb897dad01317698682f27e2a784c04b37e4b2c529881ba8e304f78413a21701b29078dbff0294910bb303c0c9e277ec744	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliyun.com\Total = "60"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "170"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\west.cn\Total = "264"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliyun.com\Total = "339"	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AUDIODG.EXEIEXPLORE.EXE

description	pid	process
Token: 33	2356	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2356	AUDIODG.EXE
Token: 33	2356	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2356	AUDIODG.EXE
Token: 33	1704	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	1704	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exeiexplore.exeiexplore.exe

pid	process
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
520	iexplore.exe
1292	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe

pid	process
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

SeFastInstall3_3261.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1204	SeFastInstall3_3261.exe
1204	SeFastInstall3_3261.exe
1292	iexplore.exe
1292	iexplore.exe
520	iexplore.exe
520	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exehahagame.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 980 wrote to memory of 644	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	86on_yes.exe
PID 980 wrote to memory of 644	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	86on_yes.exe
PID 980 wrote to memory of 644	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	86on_yes.exe
PID 980 wrote to memory of 644	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	86on_yes.exe
PID 980 wrote to memory of 1732	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	hahagame.exe
PID 980 wrote to memory of 1732	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	hahagame.exe
PID 980 wrote to memory of 1732	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	hahagame.exe
PID 980 wrote to memory of 1732	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	hahagame.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 1204	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	SeFastInstall3_3261.exe
PID 980 wrote to memory of 520	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 520	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 520	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 520	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 1292	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 1292	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 1292	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 980 wrote to memory of 1292	980	14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe	iexplore.exe
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1732 wrote to memory of 1496	1732	hahagame.exe	hahagame.tmp
PID 1292 wrote to memory of 1704	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 1704	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 1704	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 1704	1292	iexplore.exe	IEXPLORE.EXE
PID 520 wrote to memory of 1056	520	iexplore.exe	IEXPLORE.EXE
PID 520 wrote to memory of 1056	520	iexplore.exe	IEXPLORE.EXE
PID 520 wrote to memory of 1056	520	iexplore.exe	IEXPLORE.EXE
PID 520 wrote to memory of 1056	520	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe
"C:\Users\Admin\AppData\Local\Temp\14398d1f4fbd26cd3397efb2f4a9d0c2adc1c07dedb933b76245e8c9b57c264f.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980

C:\86on_yes.exe
C:\86on_yes.exe
2⤵
- Executes dropped EXE
PID:644

C:\hahagame.exe
C:\hahagame.exe /sp- /silent /norestart /verysilent
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\is-EDPJA.tmp\hahagame.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EDPJA.tmp\hahagame.tmp" /SL5="$6011A,1630806,72704,C:\hahagame.exe" /sp- /silent /norestart /verysilent
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496

C:\SeFastInstall3_3261.exe
C:\SeFastInstall3_3261.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.jipinla.com
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.1234.la/an.htm?yuyanzhecn
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x584
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\86on_yes.exe
Filesize
135KB

MD5
0175887432097d34b1d2ec4d3a3ff93f

SHA1
30686364ffe6ac9b782a73cd1f035d12cba3cd38

SHA256
4337462d9556a4340484cb47c48318529102658469859d8a14e076b6e0022ab9

SHA512
c8b21a1b5aee416ced041e4d1db9adc42902998bb9f4fe58a1d5417fff7b25d975ea262e44dacd7d24975070c29b88a58056ee2f8b748c693f63062deac88430

Download Submit
C:\SeFastInstall3_3261.exe
Filesize
227KB

MD5
4f4507ee01a51c40fcc71d7097327883

SHA1
a15eb26e219028908125a63aeb2032d99db83257

SHA256
73bc7bdc659b55b762092401306ae9cf76e498e6b39950a49a5eacd288b15989

SHA512
93cb8a59d95706da01cbdcd7af4604a2dce958e612bc3c6af6e1a0d060c6581504cad3cd33dd174dd3c1530b1483275aa72dc61e7061452d94ac865389bbece4

Download Submit
C:\SeFastInstall3_3261.exe
Filesize
227KB

MD5
4f4507ee01a51c40fcc71d7097327883

SHA1
a15eb26e219028908125a63aeb2032d99db83257

SHA256
73bc7bdc659b55b762092401306ae9cf76e498e6b39950a49a5eacd288b15989

SHA512
93cb8a59d95706da01cbdcd7af4604a2dce958e612bc3c6af6e1a0d060c6581504cad3cd33dd174dd3c1530b1483275aa72dc61e7061452d94ac865389bbece4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
Filesize
1KB

MD5
fc0f5f4898218ffde20450e9bed69100

SHA1
3f5e39ea06557af3c63b1bd05c25364f0005ab9d

SHA256
9bda1c1ec867a58f9ac3c88e54fd3e70ae38465d9d60e806f8905533accfa126

SHA512
ea22832eebd993047ce63b908eb652e6cbb2492d709b813e23109c7909e074dc5f3cee7276abd194fc4224f42826b0d66a674a2be599cee92d0450fa8dc2c974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
244295b21337f4527eabe689b8b70f7c

SHA1
aab8e6980f6ce2c18a876d1453584b9de286ed2b

SHA256
302b4307cdbcd621119ab52f479fb06c971da63a9292b886fa54325464e66837

SHA512
78f6f0a477d609d28ca49bd344a0ef536e81cf6b4c1cd54830dbc32d6bf5334b2511b74decdd63e95d059242dea9d71d7eb251dfc92cef2abfff4c59eaa6e264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1ebaf0e456e12dee3415b95359d2c7b9

SHA1
e3d1a8e8c8a28f2f40966ce7ab24df97d088b272

SHA256
95237982b25f4725bc319417f7c4bc45c38a7d6189f920ba0a551e5afac568ef

SHA512
9780b59871f75f04060d380d91d0f4b8e7b924829d1391987022d892e585714b19b8245be9793cef0cffba57bea53b65e811b4925de869a87a1484cdb7ffa99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
Filesize
492B

MD5
4787d0426d0b68dd66eab43ce2905d43

SHA1
c25f3dec215de601786c33ec3a55b58108e5147d

SHA256
80a3ff81a713d3fab16c61ba85f925f7fe82abda1dafecea562a5bdb4e2abdbb

SHA512
7ea55717bc318b41669539dc127870836ecf4259e988d94baa59e68cbd9fa35c8ac53261f6d98d88428f85967b1c69d6c2e06dd22167999c199b0aa666e43637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C65EA731-42C2-11ED-A20B-4279513DF160}.dat
Filesize
5KB

MD5
23c80a4026e4db5761bdd94a50cd9448

SHA1
7d0ca4fac189b58dea410c43f594f836abe83ac4

SHA256
402580e695a260e90f7182de409dbfbd60dec5a28e54cc1c161da727e901aa01

SHA512
a15cef001ff33ad2c5993c5df385414d7e29c7344676d734342f4bf6eb0c334a0c10d1f57433153e97ba3581801bd1a767953b1dd140013067c541f20f2847cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C65F4371-42C2-11ED-A20B-4279513DF160}.dat
Filesize
3KB

MD5
17f0bde1529c9ad1a332336e2c43f02a

SHA1
153e375101b9ad69fe17e8d481ab627dcbaaed8e

SHA256
b41d078b13d8a8a907a74afc060a092a7794d8921b65698626b41ab8ac65d95a

SHA512
043558ca06582d96e315857d7af2138e8083a9c6f496e38e811caa968b6a8ac9de81b028ed3f86c00a2733e1d532eeadfed610c343df05239ae5d9d06febbd78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
4d162607e44c95227cf09f152e89ca7f

SHA1
0fc3335e34f232906c10d5eee9798eda43903133

SHA256
ece98618c83cb5c5c3595776f8a2ccde610164d10c1b2ed8473855cc1b99e6b4

SHA512
455b2f0cd1998b30b61e78157b47d0fc8c46e8620c222463425923bb4a9dd8991596e1b867d800b7cc494560da3a1c8c5e9320bf06ec7b7a12a305394d356a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EDPJA.tmp\hahagame.tmp
Filesize
682KB

MD5
d0699dfc3ff2c8980f167c7ab586dfcc

SHA1
c3f4aa0a542c01a0251782e48b313cbb7c5941a7

SHA256
52361d23cd961a2918dd0ca57306bb9d1cf9aa65f518d2b4d11147ef1f657175

SHA512
ea55708ba81207a55dfaf8e4ab77e837086d83b27c185942ce6b228f0844d4dc3e26cddd39cfda60ebf34a4f449e563f47ad46ba72e45a133e898e2a038fbf69

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EDPJA.tmp\hahagame.tmp
Filesize
682KB

MD5
d0699dfc3ff2c8980f167c7ab586dfcc

SHA1
c3f4aa0a542c01a0251782e48b313cbb7c5941a7

SHA256
52361d23cd961a2918dd0ca57306bb9d1cf9aa65f518d2b4d11147ef1f657175

SHA512
ea55708ba81207a55dfaf8e4ab77e837086d83b27c185942ce6b228f0844d4dc3e26cddd39cfda60ebf34a4f449e563f47ad46ba72e45a133e898e2a038fbf69

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WI37W5SF.txt
Filesize
608B

MD5
15c6f5dca2e695d132f196a00567ba47

SHA1
f2e8dd3ad70fac599fc2d3807922d2661f432795

SHA256
8438339581ce2776eaf1cba4ffc3358d64193721f7e0901f49b2eac1c71136ff

SHA512
72607d813ca14f1f40817d82eb423b1f35cdebac8a78a95ece537e8913fa59ee953064e400812fd10217ecca87cd2937314049c49eb71549c66d29728f3cba0e

Download Submit
C:\hahagame.exe
Filesize
1.8MB

MD5
0b80274947513ef334429c0c666b3c53

SHA1
eb8f8ea8b3dc913c361adcfa4f790935083c4bf9

SHA256
4e9864adbc4b7c31cb8c1a81bb4a396459ab456640307d820f1f5d9f29e341be

SHA512
07ad09b3a021effce8cf696ac3e15be276d26e0b8d983fd64647fbac71a749a158c5b02e8399fa4c008d4a5517c2befbc3e84e02be803f0dd1f169da72fd5213

Download Submit
C:\hahagame.exe
Filesize
1.8MB

MD5
0b80274947513ef334429c0c666b3c53

SHA1
eb8f8ea8b3dc913c361adcfa4f790935083c4bf9

SHA256
4e9864adbc4b7c31cb8c1a81bb4a396459ab456640307d820f1f5d9f29e341be

SHA512
07ad09b3a021effce8cf696ac3e15be276d26e0b8d983fd64647fbac71a749a158c5b02e8399fa4c008d4a5517c2befbc3e84e02be803f0dd1f169da72fd5213

Download Submit
\Users\Admin\AppData\Local\Temp\is-EDPJA.tmp\hahagame.tmp
Filesize
682KB

MD5
d0699dfc3ff2c8980f167c7ab586dfcc

SHA1
c3f4aa0a542c01a0251782e48b313cbb7c5941a7

SHA256
52361d23cd961a2918dd0ca57306bb9d1cf9aa65f518d2b4d11147ef1f657175

SHA512
ea55708ba81207a55dfaf8e4ab77e837086d83b27c185942ce6b228f0844d4dc3e26cddd39cfda60ebf34a4f449e563f47ad46ba72e45a133e898e2a038fbf69

Download Submit
\Users\Admin\AppData\Local\Temp\is-R2BEI.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-R2BEI.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/644-55-0x0000000000000000-mapping.dmp

Download
memory/980-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1204-80-0x0000000000240000-0x00000000002EB000-memory.dmp

Filesize
684KB

Download
memory/1204-82-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1204-68-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/1204-85-0x0000000000240000-0x00000000002EB000-memory.dmp

Filesize
684KB

Download
memory/1204-60-0x0000000000000000-mapping.dmp

Download
memory/1496-71-0x0000000000000000-mapping.dmp

Download
memory/1732-77-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1732-69-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1732-63-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download