Overview
overview
3Static
static
元神电�...to.dll
windows7-x64
1元神电�...to.dll
windows10-2004-x64
1元神电�...ib.dll
windows7-x64
1元神电�...ib.dll
windows10-2004-x64
1元神电�...vm.dll
windows7-x64
1元神电�...vm.dll
windows10-2004-x64
1元神电�...er.exe
windows7-x64
3元神电�...er.exe
windows10-2004-x64
3元神电�...ib.dll
windows7-x64
3元神电�...ib.dll
windows10-2004-x64
3元神电�...on.dll
windows7-x64
1元神电�...on.dll
windows10-2004-x64
1元神电�...UI.dll
windows7-x64
1元神电�...UI.dll
windows10-2004-x64
1元神电�...PF.dll
windows7-x64
1元神电�...PF.dll
windows10-2004-x64
1元神电�...QQ.xml
windows7-x64
1元神电�...QQ.xml
windows10-2004-x64
1元神电�...rd.xml
windows7-x64
1元神电�...rd.xml
windows10-2004-x64
1元神电�...ub.xml
windows7-x64
1元神电�...ub.xml
windows10-2004-x64
1元神电�...pf.dll
windows7-x64
1元神电�...pf.dll
windows10-2004-x64
1元神电�...re.dll
windows7-x64
1元神电�...re.dll
windows10-2004-x64
1元神电�...ss.dll
windows7-x64
1元神电�...ss.dll
windows10-2004-x64
1元神电�...om.dll
windows7-x64
1元神电�...om.dll
windows10-2004-x64
1元神电�...el.dll
windows7-x64
1元神电�...el.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
元神电脑教程/原神电脑启动器3.1版本/BouncyCastle.Crypto.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
元神电脑教程/原神电脑启动器3.1版本/BouncyCastle.Crypto.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
元神电脑教程/原神电脑启动器3.1版本/BrotliSharpLib.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
元神电脑教程/原神电脑启动器3.1版本/BrotliSharpLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
元神电脑教程/原神电脑启动器3.1版本/CommunityToolkit.Mvvm.dll
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
元神电脑教程/原神电脑启动器3.1版本/CommunityToolkit.Mvvm.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
元神电脑教程/原神电脑启动器3.1版本/Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
元神电脑教程/原神电脑启动器3.1版本/Launcher.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
元神电脑教程/原神电脑启动器3.1版本/MetadataConverterLib.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
元神电脑教程/原神电脑启动器3.1版本/MetadataConverterLib.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
元神电脑教程/原神电脑启动器3.1版本/Newtonsoft.Json.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
元神电脑教程/原神电脑启动器3.1版本/Newtonsoft.Json.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.UI.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.UI.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
元神电脑教程/原神电脑启动器3.1版本/Panuon.WPF.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/QQ.xml
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/QQ.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/discord.xml
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/discord.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/github.xml
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/github.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Converters.Wpf.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Converters.Wpf.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Core.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Core.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Css.dll
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Css.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Dom.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Dom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Model.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
元神电脑教程/原神电脑启动器3.1版本/SharpVectors.Model.dll
Resource
win10v2004-20220812-en
General
-
Target
元神电脑教程/原神电脑启动器3.1版本/Resources/Icon/QQ.xml
-
Size
1KB
-
MD5
176640a4b5354bcd204a2c4b3499110c
-
SHA1
a01ad372cb978559a7911c43db03ea87fca368f4
-
SHA256
0d00e6329bcaa3294cd22c546b067967587c525fda5ff1d16836199333213ec6
-
SHA512
16fc68670446d17e28410a89e9738b66fb88b95d6773de3f26c9d0c7c34bf14a03aa8a077cba3c7fa7327b843b4b2410da1f06929025aa0b36c85d8286eb90d5
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371698789" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C328681-444E-11ED-977F-FAF5FAF3A79A} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000d6ce108fb6ce8693bf87229a57115a11883f72fad3693fb53378e2d9981362f9000000000e8000000002000020000000bf7de19e8fdebfd41071f7301e14015863b55279dc1f39429098d502d6b8263820000000f824c000b222ae72b950205ffa538b5a1fd57aa3bc79b16aa07c4aa01cbbf28b40000000e54e592c7a88e0a3d6dd7c7dccd254d11a1bc7cb14c011dd7ef1722e5b9ae4dc9e1f814b0028ef3cdeda23d335c5b4e95442eaf792373b8962ace5fa6f6212cb IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308664045bd8d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000005f8e32c297087f2a2d035045b3bcbd6b645f50afc56610fd41a3e098f8b18c7e000000000e80000000020000200000007bdb06135e85e04a55f6e1ecbd8d3e82ac1dc8c1c5da1976a3994fab06a34290900000002b7dcfae3f847c7ce0c13069c4e5ed5b72785c5d8f6cfd43e9c0cc110c103dbc61664f5b027913b8a0d3312e4cb1d0e5aed3d585adaf764d7e120fa80d4e09f40ba8b848414b3e4aab77b4febea09ac21da4c860df1abec215f9b4d9ad9f60cad246f93ffa5e3da55bad761df3aadb07f21540df671f536bebdd867dfac4dcd65b70e578907c30f19c365d562d363b2140000000c45fc19cc18c5f40f9b0392c3c8c96104d9bd75ae0c14101791a1093f0864bb356aa888fa9fa9d5fac5ab8e1eb6831d3bcb3c9b3fdd34b6ff8ebd30c9908a527 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1924 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 1464 IEXPLORE.EXE 1464 IEXPLORE.EXE 1464 IEXPLORE.EXE 1464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 576 wrote to memory of 944 576 MSOXMLED.EXE iexplore.exe PID 576 wrote to memory of 944 576 MSOXMLED.EXE iexplore.exe PID 576 wrote to memory of 944 576 MSOXMLED.EXE iexplore.exe PID 576 wrote to memory of 944 576 MSOXMLED.EXE iexplore.exe PID 944 wrote to memory of 1924 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 1924 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 1924 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 1924 944 iexplore.exe IEXPLORE.EXE PID 1924 wrote to memory of 1464 1924 IEXPLORE.EXE IEXPLORE.EXE PID 1924 wrote to memory of 1464 1924 IEXPLORE.EXE IEXPLORE.EXE PID 1924 wrote to memory of 1464 1924 IEXPLORE.EXE IEXPLORE.EXE PID 1924 wrote to memory of 1464 1924 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\元神电脑教程\原神电脑启动器3.1版本\Resources\Icon\QQ.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1464
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
601B
MD5b217daa595a50cb2409d03f3be67efc2
SHA1821e1656560688c1dd7aae16948415b59a32b32b
SHA256d31a5e87a7642b1d382ae6fc0927dc6ee921ae82f97d6ebc7f134bf1d2593f87
SHA512d448724dca5bd50520a6d3dcfb3ba897aaf6b315b2729f923f1de99371fdc7d26aa30174ddd9c05c2fcd897035f373684148fe23f8f4102d707cc68c0595191a