ffaf67e89ab49855c55ed072986c4f6d44a1dc741a160cf8c092a5a488bebd2b

Resubmissions

03/10/2022, 14:54

221003-r9zsnabga8 8

13/08/2022, 08:37

220813-kjjkesfgfp 8

Analysis

max time kernel
96s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

下发结算报表x.exe
Size

3.1MB
MD5

a1d5dec080c558948387f534faa69dc9
SHA1

abe75b88a5305b5eda6ee76d6247d2a26f5b4404
SHA256

bf4ed8d5dc017a7346f7981ce4db8156c1b76b0cd6f9a37394378371fb548870
SHA512

c6d61cc740b0ef8da442401fdfa227a282fb831e049b5d927d085fe45fc0fe1f1df5f39b4d6204f68c2d4a2e7a822ff27278582925aa339ce74e5abec7280a59
SSDEEP

49152:010d8NIEd6k43D1Sef6oTxqDD3WOfGxyQvEc1Oey8UfIL7dLNuSlHjJr6EL7dLNF:rdGgkY0oTwDD3W4GKeYfUr6Lnr6

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1044-54-0x00000000010A0000-0x00000000014DC000-memory.dmp	vmprotect
behavioral1/memory/1044-56-0x00000000010A0000-0x00000000014DC000-memory.dmp	vmprotect
behavioral1/memory/1044-57-0x00000000010A0000-0x00000000014DC000-memory.dmp	vmprotect
behavioral1/memory/1044-71-0x00000000010A0000-0x00000000014DC000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 49 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000000c55cb701100557365727300600008000400efbeee3a851a0c55cb702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Music"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 78003100000000004355e58611005075626c69630000620008000400efbeee3a851a4355e5862a0000007c0200000000010000000000000000003800000000005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 74003100000000004355ee8611004d7573696300600008000400efbeee3a851a4355ee862a000000820200000000010000000000000000003600000000004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000004355ee86100057425447585700003a0008000400efbe4355ee864355ee862a000000f5220100000008000000000000000000000000000000570042005400470058005700000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616209"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1044	下发结算报表x.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	下发结算报表x.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
988	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1536	1044	下发结算报表x.exe	28
PID 1044 wrote to memory of 1536	1044	下发结算报表x.exe	28
PID 1044 wrote to memory of 1536	1044	下发结算报表x.exe	28
PID 1044 wrote to memory of 1536	1044	下发结算报表x.exe	28

C:\Users\Admin\AppData\Local\Temp\下发结算报表x.exe
"C:\Users\Admin\AppData\Local\Temp\下发结算报表x.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Public\Music\WBTGXW
  2⤵
  PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Music\WBTGXW\AGEBGYP.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
C:\Users\Public\Music\WBTGXW\ANTQOTM.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
C:\Users\Public\Music\WBTGXW\DOCHHUO.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
C:\Users\Public\Music\WBTGXW\HODWRFD.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
C:\Users\Public\Music\WBTGXW\IXSHHCU.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
C:\Users\Public\Music\WBTGXW\MKPCPSU.url

Filesize
136B

MD5
a2d066e8280bba19b4c33655e01adc85

SHA1
6129297a8f14cb7f9199db595fae66a98d59ac55

SHA256
8b54305558fff5275e753561dfa44cc4079023ba16c5e984156d37cc4adf8cff

SHA512
f47b5d581d7dd03fbd41547d074210111d4efab9f3ca81d0cdd075b7a76457770a769b97146a8d8ed463ef3c8c99ea584a24bb703eb47aeb3a646ec95cad2d02

Download Submit
memory/988-61-0x00000000036C0000-0x00000000036D0000-memory.dmp

Filesize
64KB

Download
memory/1044-62-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1044-63-0x00000000748B1000-0x00000000748B3000-memory.dmp

Filesize
8KB

Download
memory/1044-57-0x00000000010A0000-0x00000000014DC000-memory.dmp

Filesize
4.2MB

Download
memory/1044-54-0x00000000010A0000-0x00000000014DC000-memory.dmp

Filesize
4.2MB

Download
memory/1044-56-0x00000000010A0000-0x00000000014DC000-memory.dmp

Filesize
4.2MB

Download
memory/1044-70-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/1044-71-0x00000000010A0000-0x00000000014DC000-memory.dmp

Filesize
4.2MB

Download
memory/1536-59-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download