Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 05:05
Static task
static1
Behavioral task
behavioral1
Sample
119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe
-
Size
1.2MB
-
MD5
5f666bd3759c70d9e6ab59cad547dca1
-
SHA1
85c22c89aaff94dba3f4ae24ccb47c6a148750d6
-
SHA256
119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd
-
SHA512
f496124b29a9a58cb1fb90910cd1ea0eacb3dcaabdd7a4da1b20e9778fe67e115d51f9895a6ec7b865d41075ba96a2d0c7b21c72624d2826a40d517acbc41f51
-
SSDEEP
24576:W84Fb6PHUotlxRz0rs2u62W5su0S7sBpbum:W/6PHpMA2u6L0S7sBpKm
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\progra~1\ico\$dpx$.tmp\ba628f9db0aee641acd830d98d5c802f.tmp expand.exe File opened for modification C:\progra~1\ico\meiv.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\930901ad9c36e648ba3211fa31ddec6b.tmp expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\20c822324b6f5d46b42a4ee2d482c2e2.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\c9629b67fab6134b94c4147bb5d3dfec.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\c33519839f089542a87692ee34b374f1.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\186b0c4c0ce6a44fa3d0643f10915736.tmp expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006ab330b1df8157721e1d567ec71f97b31305b8c1454f9707784f2d82a9ee253f000000000e8000000002000020000000ab8bf51f075e0a474193803edf7358721e7bacb60102ddbc07a5b8ef8ba6fbe190000000f3c61cfe59cf003dc447f15e81ce040c4e28c4ec3cf801ce7456c844dc4e85cc30a78c91e03bc877efa2cc3180c8e092b006e279953e523b3d5d0a6bb574e1fd2d15e0abae561b478e963378e1501bd773054b456724a797bf95b9fb3d949588bdfa67865ddeff4e75dcfd6fc50dfbf35f178c97e053e7dc1540f1e42dfeec4a8d63b497499e2aaa615799b27fe0225440000000e5199b9aa362815693a4d9c2548d0d11813bb3474673c7bc9b4e47d86bb06d07c58cacc41ed50e08dfd84033b95e2a5f0175f6da48f33545b19679861de81712 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373122166" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{401E0761-5140-11ED-AAF5-C244376E7EDB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006058289951242501e58ce0728b5f708a8d0c1b1649911e528d36ad9b343b1f8d000000000e80000000020000200000006d06c4dbae0e57b8965cbbfb959762d038a9c0c58eb95bec4dba99c0c38fd0b6200000000673543d47f4cd5cbe4eab692dc845c519a43c889fefb1b9a61ea956f900befb40000000c02c4756a217c6dd317da44ca9111bd35391317ae2e3352437611bdaad78726d1a1eaaa7113e013bfc5b3bca1cc0a950770909688baec9b4516d9a1e599f6400 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d076231f4de5d801 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1348 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 1348 iexplore.exe 1348 iexplore.exe 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 832 wrote to memory of 2012 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 29 PID 832 wrote to memory of 2012 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 29 PID 832 wrote to memory of 2012 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 29 PID 832 wrote to memory of 2012 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 29 PID 832 wrote to memory of 1256 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 28 PID 832 wrote to memory of 1256 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 28 PID 832 wrote to memory of 1256 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 28 PID 832 wrote to memory of 1256 832 119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe 28 PID 2012 wrote to memory of 1912 2012 cmd.exe 31 PID 2012 wrote to memory of 1912 2012 cmd.exe 31 PID 2012 wrote to memory of 1912 2012 cmd.exe 31 PID 2012 wrote to memory of 1912 2012 cmd.exe 31 PID 1800 wrote to memory of 1348 1800 explorer.exe 34 PID 1800 wrote to memory of 1348 1800 explorer.exe 34 PID 1800 wrote to memory of 1348 1800 explorer.exe 34 PID 1348 wrote to memory of 1512 1348 iexplore.exe 35 PID 1348 wrote to memory of 1512 1348 iexplore.exe 35 PID 1348 wrote to memory of 1512 1348 iexplore.exe 35 PID 1348 wrote to memory of 1512 1348 iexplore.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe"C:\Users\Admin\AppData\Local\Temp\119968377cd04f8b469a577f87bc71da7f3e734aab86a5067dafe6d84e49d1dd.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:1256
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\opIhS.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1912
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
603B
MD568e696440de831b284c795be33976b9f
SHA1424cc1d53076a218c690f2cb2e72dc1361bc79c1
SHA256439417e69fd5b2e90bd51fa3ae05499d640ba2ffa4ef1b9ce706f9152286382d
SHA512c20bba7ae57f60a19bf9c6f9aff48fa1eb9c8acabd05cc8cc913773bfcd4e9ce96034e74d1ee7210066021a3d77842d3a5b15dd69721538de91fd18fa7b7cd8a
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f