Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 11:46
Static task
static1
Behavioral task
behavioral1
Sample
0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe
-
Size
1.3MB
-
MD5
64c1dbb3a3cef7560342c9cc8018ea63
-
SHA1
a3221bc9d1ebea3832785088317b9fea68772c6a
-
SHA256
0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5
-
SHA512
ddce9e45d275cab66e9d76f15563aac26e28aeadcb7b1628be3f3296c5091ef13974027456b2aa19e8345cb4febc94bf6bfc421046273c62199abe0417613c63
-
SSDEEP
12288:HGrHG7Wvc1t1oPG7qTBHtQzBC2bNmx7ENkkHqEGRcoMegNI6J74zdvgvF01Nz:HGsYcX1omqTBHt32bNXxHqELmk4zd4uv
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\7808c8af6f819b44b36435d8b28de1de.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\c5923713635a3247b116d33c48e88ff9.tmp expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\d71af4a661235e459b4d90b1f013d2f5.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\45f2d1213be94d449d8812df3249a03d.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\70f9521efed04e4abe8073d9c47d73f3.tmp expand.exe File opened for modification C:\progra~1\ico\Music.ico expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\d7be1d8675ba004db3d3d982114894d0.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c1391830d7d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000001bff7c04958e2b794710c016a786ba08d7c1f01d219148881de02de2bd19c29000000000e8000000002000020000000fe7f68d8eefbc47e4c67c2e49053aa06abddb985e8a9101716a9bf1d3b5a0d6820000000bd8306d8715cde653ca62b6eee33a465faae03d5b30b412e83953a7922a9961b40000000bc55c7411e8785df08c3c70043992749ab5b375f20ae0409e488370b847cb470f6b1583f6efbaf66bd4fffd846a09eb686ede696b848eb4dc6f42fbbe8decd95 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000007ced44b740c56f52016b0ce05fc9072f589584aac7078cfb05232a2a075dc56b000000000e800000000200002000000009c7f9f57542cd9cb6c98c6068564ea451d772f35c020aa04909499a670b5df4900000002fe31c245471fe67763334528c8c7fb183e85548bf99df969648ee51df814b8d0c11607e5cf8452827fc38c36221b338e21440fc9fb67fb243db2fb1b1b6ceb2369a72ae54224167c31e36ac95cd1745c728798f28aab70a6d68e5a4c136dd1e08de4a80aa5fa5244521c693d64e9663f33110065162a90558214d77186dd4d9aaf9ccd692a177925f0786bac05f071040000000a5aaa7e71239a7bfa1df399147b23f443ef19dc69252b9f8bd77b6b0e302d13f9bf1aabaca0c9c20684f7e47f3035fe9a693834caf29265f4f717e8f7156939c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371570367" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29103DC1-4323-11ED-BDAB-FE41811C61F5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1616 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 1616 iexplore.exe 1616 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1048 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 27 PID 1916 wrote to memory of 1048 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 27 PID 1916 wrote to memory of 1048 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 27 PID 1916 wrote to memory of 1048 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 27 PID 1916 wrote to memory of 560 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 29 PID 1916 wrote to memory of 560 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 29 PID 1916 wrote to memory of 560 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 29 PID 1916 wrote to memory of 560 1916 0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe 29 PID 1048 wrote to memory of 1196 1048 cmd.exe 31 PID 1048 wrote to memory of 1196 1048 cmd.exe 31 PID 1048 wrote to memory of 1196 1048 cmd.exe 31 PID 1048 wrote to memory of 1196 1048 cmd.exe 31 PID 1112 wrote to memory of 1616 1112 explorer.exe 33 PID 1112 wrote to memory of 1616 1112 explorer.exe 33 PID 1112 wrote to memory of 1616 1112 explorer.exe 33 PID 1616 wrote to memory of 1272 1616 iexplore.exe 34 PID 1616 wrote to memory of 1272 1616 iexplore.exe 34 PID 1616 wrote to memory of 1272 1616 iexplore.exe 34 PID 1616 wrote to memory of 1272 1616 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe"C:\Users\Admin\AppData\Local\Temp\0a582632d313ad72c793bb45fd36a31efaf7c03e7a35c37aad7cf0cc2cf522e5.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\xTrJu.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1196
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:560
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
603B
MD537ce94b1f594512081cccea7edcc8f33
SHA16d351d31b96dbe0fddd67fcca9aad0f7085178ed
SHA25636eb3f620b01441b9e5531f45735cfd8d3a97d1b3cf42c644cc519a6548acf72
SHA512fb1b9b4cb842f9fe5bcedbf42cca488478c81a36c23a619a4fff13df22a1237934140be4b1b3a97082ad1a18552caab196433816673149be030c71cda653a314
-
Filesize
18KB
MD5f462d70986dc71a5ff375a82bd9e3677
SHA1f3d9c09a0ff51d81377e15ae4e0e2fceaede142b
SHA25669528b0fb4e1bc3fb8d92839d98e0717b3f680d98fdfcb9809a2f557aacab295
SHA5125bd2d67bb78dc8c4275390667c135ed10c4733e46ce58ef524ea79869f740db00d2f4a37b949896edcbf1ebbfa1ab4dd16afab4418ff637322883435bb7543ec