Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-10-2022 16:42
Static task
static1
Behavioral task
behavioral1
Sample
86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe
-
Size
1.2MB
-
MD5
a0c833e7b57d75a8ab288bb5f9414409
-
SHA1
945f74980e6df70404138f4f1d052173817f1480
-
SHA256
86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868
-
SHA512
cd06daa050e76d9025778f0773aed95ddfa103a6750ee1b3809fec5b86911695a1f76f12cb5b5799818f69b8c3354a332473f6d3037bab503de9eeb7185f8604
-
SSDEEP
24576:z84Fb6PHUotlxRz0rs2T62W5su0S7sBpbum:z/6PHpMA2T6L0S7sBpKm
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\meiv.ico expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\63952cd6b6d3df42bd3662d1682135e7.tmp expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\acf85585735a9542a61c143331d7aceb.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File created C:\progra~1\ico\$dpx$.tmp\1f6184ce514f7d4cb098d60e3c717034.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\40b29bf2c7b0254b970523aec7b2102b.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\c2794f6244e7284893a3f203dc84fbca.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\9f3c041103d918438deb7adac7ab088c.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372978781" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{678BC2F1-4FF2-11ED-A6C3-FE72C9E2D9C9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000a55d31fe24aff05262ca0aaa17058c0d6c2c649ae66921cda423f3d302254b0d000000000e80000000020000200000006e3e0e66bc47c01fe236ac8bf45ad0da0eb66ff6eaa494ff587ab67044b51c9920000000390854536c136a546f0e8cc6b7e8dbe952c07fa992f1d9557d39811ed8ec0a8940000000ee0d7df3ddde5acb9f4b798d19c86954d48e499e6003269e1f1a967353fefb588ffab63b40f4b24c07963c30d47d0839adda4ed44fc48e64a4919ab89d911e6a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09f5c51ffe3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000071d1ef6adb87a068e7ca3779d0e4deaba96678fea97f70cf0393f1dc6075b4a3000000000e800000000200002000000030a68fb50fb0b0690746fa46c874d80d46207dd54851efe1dc0c653086103dd390000000256848315f0f8fa154f80fb6e2259bf4fba3474383009e04c0481d47689f762e939d1e344df40019f2fa05e837c5b2de4d93f78a023bc0e80d2436787aa5300f2def65a780caf5b6aac7bb397dd8eb808414b54384d2822f1781f30278f4368cd1023aec14a2ca595ace1edfa9af0d6a3756d335f084434e106fe26b5fc932e9dee4a7b252e8b3e24bef7a392254888240000000bd1f830869e639a434a9114e6789b7cab525cb77e653d7619522e3de93e6de723b793be91e69b8224bf18266f9de49cb44382a4dff056869d1b182409ac3ef80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1064 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 1064 iexplore.exe 1064 iexplore.exe 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 900 wrote to memory of 1704 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 28 PID 900 wrote to memory of 1704 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 28 PID 900 wrote to memory of 1704 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 28 PID 900 wrote to memory of 1704 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 28 PID 900 wrote to memory of 884 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 27 PID 900 wrote to memory of 884 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 27 PID 900 wrote to memory of 884 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 27 PID 900 wrote to memory of 884 900 86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe 27 PID 1704 wrote to memory of 808 1704 cmd.exe 30 PID 1704 wrote to memory of 808 1704 cmd.exe 30 PID 1704 wrote to memory of 808 1704 cmd.exe 30 PID 1704 wrote to memory of 808 1704 cmd.exe 30 PID 1772 wrote to memory of 1064 1772 explorer.exe 33 PID 1772 wrote to memory of 1064 1772 explorer.exe 33 PID 1772 wrote to memory of 1064 1772 explorer.exe 33 PID 1064 wrote to memory of 1532 1064 iexplore.exe 34 PID 1064 wrote to memory of 1532 1064 iexplore.exe 34 PID 1064 wrote to memory of 1532 1064 iexplore.exe 34 PID 1064 wrote to memory of 1532 1064 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe"C:\Users\Admin\AppData\Local\Temp\86034333106e4cbde88e000bdc18d7fcca0e0bbdbe2bc541c1ae2acf8d23d868.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:884
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cEova.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:808
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
603B
MD519d8c18d3a2c4866ebbfd80447d76154
SHA17612d9f4104a1e29fa4322fa1f011970e0067b3a
SHA25663ccc2f436348cdf707f16ecef73b0e18c6da84a2f73a4598a37fda402804ea8
SHA51280a3cfc96687af0854601763f5a5fa18fac3bd10715aba655470b79090c4625d604ab0a2fb5cb401905611c20cb3bdb3e6bc22372b162a2ec75ace5783b693f6
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f