Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2022 05:24
Static task
static1
Behavioral task
behavioral1
Sample
56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe
-
Size
212KB
-
MD5
5425fed3d805a988da16ce27dc6f6024
-
SHA1
b5468f6eac632d25a213275c03c77702896651bb
-
SHA256
56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230
-
SHA512
66f669b24844d4416f505abd28c615203bd9205fb5e7f2a44d0240d893ea3ed1b51d507be1180b4df1e1235658f2c88f8233cb2a8339c17807078e2b99f8a8c2
-
SSDEEP
6144:dcyyU/A5rZRLEhFTnRa26s+Wdz8V7Wdfwn1nbmuSDmk:dHp/urb4A1WdBfr
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4564 Program Files4MT0N6.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\t.ico 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe File opened for modification \??\c:\Program Files\Common Files\d.ico 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373131545" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000062f83db2769fd7515e8dab083321d19d2a7269d0239aca184518f564d1be420000000000e8000000002000020000000fc25be72c5b11c3b06c6b8f24cd849c33a4a5f40c70d0cba84e3feec1176d88020000000ec01297f2d5a41941e1a5c9caf41c1a1b5fc7f32159afcaf103121c860baad0a40000000307f0f361af619a5fff86e7583304474d9004f8fed3a201e5aecb961089803c0d69be6ccc4ef9a3df7f543e6a4e90c91c64e5b065024ffa5ccf270f51d412384 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991714" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991714" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000ead156b848b058a168e515b6ca765a3e74bc3530934bd605c22e5c4c262eae92000000000e80000000020000200000002a4837e32074524250dd3b7367172bb8322ce655f36223af13139f5a3a5efc5820000000da02a0c3906d9ae93cc39156e31989851612ea1f73c4c95f7ecb094e52bc66cb40000000de866555299e471189ce05d3f23e9bb73592121589a2c224106af45cb0ef2fd7f64bae8e404d0647d6d40eaf8807a9a53e1bf74ae6a174df5829104fe396711b IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bc6af862e5d801 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991714" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604aaef762e5d801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3804466602" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3955249236" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0C4FE414-5156-11ED-AECB-C264E7FE3618} = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3804310796" IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 224 IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 224 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 4564 Program Files4MT0N6.exe 224 IEXPLORE.exe 224 IEXPLORE.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5000 wrote to memory of 4564 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 81 PID 5000 wrote to memory of 4564 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 81 PID 5000 wrote to memory of 4564 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 81 PID 4564 wrote to memory of 224 4564 Program Files4MT0N6.exe 87 PID 4564 wrote to memory of 224 4564 Program Files4MT0N6.exe 87 PID 224 wrote to memory of 2568 224 IEXPLORE.exe 90 PID 224 wrote to memory of 2568 224 IEXPLORE.exe 90 PID 224 wrote to memory of 2568 224 IEXPLORE.exe 90 PID 4564 wrote to memory of 2756 4564 Program Files4MT0N6.exe 91 PID 4564 wrote to memory of 2756 4564 Program Files4MT0N6.exe 91 PID 5000 wrote to memory of 3840 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 93 PID 5000 wrote to memory of 3840 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 93 PID 5000 wrote to memory of 3840 5000 56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe"C:\Users\Admin\AppData\Local\Temp\56259aeda9cbd5498eab6de3a5fb8de4f7f1982d7e52de5ea11d1e45e8178230.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\Program Files4MT0N6.exe"c:\Program Files4MT0N6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:224 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:2756
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:3840
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5a39072ae25391c08392af74ac9a6d5fd
SHA18f520e2f7b3cc35ea0ca10b606379945d7db2034
SHA256058c92e4867bf3b244216786b9c0fadf861956b87ebd32154f0afdd95cc00a03
SHA512c84f8871f0086e5e590e41cee5fcace70492d6ad2d1a35aa9ff88c21a89e1365308da0dce77df1914a0f075a32ed4e5939414e89c6f52a72803c594d83b478d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD57550b85aee4221c59808672005ed8855
SHA1aeb269eff06f518132b9ecea824523fa125ba2d2
SHA2562b1c1e36c5419b7b3351aad8a08fee019473c832fe242ec2bf438b160d5eb8b2
SHA512216d401cb461099f7d2f3626957800cba77308b790ec181e2affb97339570bb9e168a56f3264cad79cd60589637679728fb2a87199a91667dc3ccfd4117f2bab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD55dd3d37963b7862633d1cb5c034df47e
SHA1824637b78800f121c857283f535972b451ca1e2b
SHA256ffa10a1df4bd6248242263c29e0a13625ac570d6d4376335c0bd2e427663f40b
SHA512b32260d8665efe09a235720c92a881ccf12086c0b24484848147ffe0997b425f293ca12d1b7c7616c0edd0c5fe2117ae1d71a1c91b1794c9ac4fedae0527e859
-
Filesize
486B
MD5340efa9ce90a8c057178d1295e999354
SHA17bcbeef550d74b554d84b166d72de5a66a4afd21
SHA25655eb47aa67a4ef38cc7ed97fcb70a511892a2dcc8fb1e7580083f7af5a621e6d
SHA5124a12a3e0f9b189dc61df965ac1b1a8a03e53ac05bff9368b21f05c73c612ee763a9b4312cc630bbeb951fd379eb8852507ea6d87eeb94cde87990fd0c3fca105
-
Filesize
36KB
MD5a39072ae25391c08392af74ac9a6d5fd
SHA18f520e2f7b3cc35ea0ca10b606379945d7db2034
SHA256058c92e4867bf3b244216786b9c0fadf861956b87ebd32154f0afdd95cc00a03
SHA512c84f8871f0086e5e590e41cee5fcace70492d6ad2d1a35aa9ff88c21a89e1365308da0dce77df1914a0f075a32ed4e5939414e89c6f52a72803c594d83b478d0