Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 13:31
Static task
static1
Behavioral task
behavioral1
Sample
5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe
-
Size
308KB
-
MD5
65fd5314b85fc831d466182917095b2c
-
SHA1
f03570e3fdf05670e1a3975733ab3f140b16771b
-
SHA256
5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335
-
SHA512
9cdea6feff3b16d6fdc71e211b3d060f83300583e85b92458369decc82386837111ff5fd44c0b3095b3322afc8030117d32f9a4ff8e594922cfc92982a2de2d2
-
SSDEEP
6144:Q9Ufckl8VjhiAn4ORc4zCvVRsUz2olv+YXaht8+ajFfP2F/kg/xzetmh/:oNkIuvdRsUaolfaht8+UdRgJumd
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File created C:\progra~1\ico\$dpx$.tmp\68389d6b5fc9134d824691efcdfb11b3.tmp expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File opened for modification C:\progra~1\ico\Music.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\8786f2aa99a67045adb61a8c80a3b360.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\30f888f487df9045abdd01634bafc9d0.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\6f19740edc3c3d4c82e543a9007495d7.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\c60c4da484ec66449e3783db251cb4ef.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\26f2e1229c65e74da8118d23fcee72af.tmp expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371505121" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{451D7841-428B-11ED-8B83-6A6CB2F85B9F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000002c694ae2122edf21c6831b181e8d5d74fdc43a798f398bdf359df4410880058c000000000e800000000200002000000062bb28afcc72a2a59ea224396116c9008817e7bc88b24baba486b2714a3d3484200000004dd70df2b5a3e524f3334ed1f6a9addcf9157d9974249834242a811bcb5f457c40000000fdb4d1d96ed752a67d09dad60c5da06ff667d160d292cf44a8b5733ec638d0e0c79e9f704cabd5bd88f76d40a9fa63e1dbbfc0a65b44cb0573d2be204b4970a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c0000000002000000000010660000000100002000000087e57686698f3186229a108be0e83b905696696be5aa86e2c3ab077b93816fd7000000000e8000000002000020000000f9f3e3700357f8cdffdae6173a2255a7b4809f3a67bce391f7c283cebbdf951b9000000093ce1246bd0950bc7bfad5588ea73e3783d36997e846818efef1901d7e1d27b7d5de9358a1a4927be184fd11e62e329e0f07910b9ae37e2c85206ce32f97e6f1e1db39bd7c608d8a578ea20c7d404db33811f98d70003fcac418c0c092375981784cd29580439784b386e845dec54f6cac1f1247aa696bc2d7525dee0b6d8a03c038c99d582f2506909c8b81ee95a3c540000000e254b3bc96832fbefbdf6413b5d3933e6437b06fe0b31335593d9515f4dbf0dbef0f64e6398999f5f901c51e3ab2445ab5ad85866785e3a25ac971cb0aa60930 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cc0c2898d6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1400 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 1400 iexplore.exe 1400 iexplore.exe 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 364 wrote to memory of 1940 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 27 PID 364 wrote to memory of 1940 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 27 PID 364 wrote to memory of 1940 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 27 PID 364 wrote to memory of 1940 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 27 PID 364 wrote to memory of 1860 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 26 PID 364 wrote to memory of 1860 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 26 PID 364 wrote to memory of 1860 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 26 PID 364 wrote to memory of 1860 364 5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe 26 PID 1940 wrote to memory of 1460 1940 cmd.exe 29 PID 1940 wrote to memory of 1460 1940 cmd.exe 29 PID 1940 wrote to memory of 1460 1940 cmd.exe 29 PID 1940 wrote to memory of 1460 1940 cmd.exe 29 PID 1760 wrote to memory of 1400 1760 explorer.exe 32 PID 1760 wrote to memory of 1400 1760 explorer.exe 32 PID 1760 wrote to memory of 1400 1760 explorer.exe 32 PID 1400 wrote to memory of 1640 1400 iexplore.exe 33 PID 1400 wrote to memory of 1640 1400 iexplore.exe 33 PID 1400 wrote to memory of 1640 1400 iexplore.exe 33 PID 1400 wrote to memory of 1640 1400 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe"C:\Users\Admin\AppData\Local\Temp\5331417e2a7ad555580e97262dcda2bdb15182b4d3fe438090403891c4551335.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tRCK4.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1460
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
595B
MD5a513363b5d422cd7574c701fa83a87dc
SHA192e938a48507c4a56c9b37b8c42d56107ac6436f
SHA256b5f1552ae2311d767bb7b83fa4c85c3aecd987fa732a85c0fd822c3948266b59
SHA5124eb82c2b178b6b8764a3c02d96f7bf6b1ac6f425b560c7c60da51ec5c4248e98598a8c88609d302b5fba9bb31db78249cc96c20b62259cc72a90459edcf10650
-
Filesize
18KB
MD5f462d70986dc71a5ff375a82bd9e3677
SHA1f3d9c09a0ff51d81377e15ae4e0e2fceaede142b
SHA25669528b0fb4e1bc3fb8d92839d98e0717b3f680d98fdfcb9809a2f557aacab295
SHA5125bd2d67bb78dc8c4275390667c135ed10c4733e46ce58ef524ea79869f740db00d2f4a37b949896edcbf1ebbfa1ab4dd16afab4418ff637322883435bb7543ec