4f146e2a76c1befd792fb00ed88019bd30e0c3974a38a57cb0a063b1a7660164

General

Target

练习参考程序/练习6/clickDraw/clickDraw.xml
Size

10KB
MD5

f973d8cf67b2166736de325ca6d4a627
SHA1

764f0abfb51f5f4d99291709e1fba307ae6b67ba
SHA256

b518a996d06db594e8444ed2cd66b231ba1e489c32fb2cf45e294879f2b98971
SHA512

2f55d424a7a6afe254fc118bd2a7e8a30f5146da3add88c41bd5a953d215a68d9e1dc66085244f41f33be287faef8343324c42e1b1b25d0ef96300c2488e680c
SSDEEP

96:yY0/zcpM1fNOimF4mbima4G2YyaLbyaLMyaL6yaLDmPsOB9UAD/e44fh54AD/eQw:yx/zcq/RBkRbn/UfH/sfD/zfe/rfsx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000000cae12e0c78ad15e8140451e0f5b234779f02ffba07f3a9692e2b4264a0e4aa4000000000e8000000002000020000000527a80e954a20b25941371a0776d2765e60eefa97cd58e0f81358fc3f0d19911900000001f680899b72bde718c53afdc4ef5ffeb18b8cd8ec1d025f8a09c9888bf0b0d944176d5a744982ba55e1e03e20b2d56be90cee21b428b9193a4f34566e4a03fc0932d52035b8bd77959815461c2a49b7b6d226d0e62c6594ac7f95f3495b861a4a092ceb5e87f9ec9607c47fd7f182809d3f4008430b80a7ed8391794e20dec58ea75c455b5d1a2ae076f9c2df91f97b140000000f532def13d5541e257388c4f2317f6065da0139ba8cabe00f66a9fab5218a77a11df59d1c124caaf094d6c64c11e87a0f1329aabe4419682228753f964dabed0	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000010c3800527200b045a4423dfd1fa88cca42e7b53d213a44f24d49a7790bd95fc000000000e800000000200002000000099975a6b33c3d48dd52df91ab9c48e44e921ffe33e44071b4c2fee7d619817b820000000feacfad7341eb4dfd00c72775a735e5797eb76247df236880a03c7b36e69ef6640000000fe5ff64a3fc9c8b3d93cccd38815707c3c4cc0a2e04422e65cfa3a6094afd38d04d743c2cb3302c8db654377bed53a4e54102a446e4e3645ec45472887dd29c8	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{559EEE51-5056-11ED-A064-6A6CB2F85B9F} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373021715"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c6492b63e4d801	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1516 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1516 IEXPLORE.EXE
1516 IEXPLORE.EXE
892 IEXPLORE.EXE
892 IEXPLORE.EXE
892 IEXPLORE.EXE
892 IEXPLORE.EXE

pid	process
1516	IEXPLORE.EXE

pid	process
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
892	IEXPLORE.EXE
892	IEXPLORE.EXE
892	IEXPLORE.EXE
892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 968 wrote to memory of 1764	968	MSOXMLED.EXE	iexplore.exe
PID 968 wrote to memory of 1764	968	MSOXMLED.EXE	iexplore.exe
PID 968 wrote to memory of 1764	968	MSOXMLED.EXE	iexplore.exe
PID 968 wrote to memory of 1764	968	MSOXMLED.EXE	iexplore.exe
PID 1764 wrote to memory of 1516	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1516	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1516	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 1516	1764	iexplore.exe	IEXPLORE.EXE
PID 1516 wrote to memory of 892	1516	IEXPLORE.EXE	IEXPLORE.EXE
PID 1516 wrote to memory of 892	1516	IEXPLORE.EXE	IEXPLORE.EXE
PID 1516 wrote to memory of 892	1516	IEXPLORE.EXE	IEXPLORE.EXE
PID 1516 wrote to memory of 892	1516	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\练习参考程序\练习6\clickDraw\clickDraw.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CE9G56N6.txt
Filesize
603B

MD5
56647da1be3036c42be4c978f097f664

SHA1
61dcca008f357f1e516a6557c5da346511ee3ab9

SHA256
ead8e08a21bda727f820079b5894a87682cca47aa179cbf7b036e22c57afb4c8

SHA512
b8a810daf1f6b5c9620eb906a58059b45bcc29155598b19563da1ae6935e090586f4adc3716a474e95804e4a3bb1c620c36c5ddb054f34ccffbd9f42d1aee69c

Download Submit
memory/968-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing