Overview
overview
4Static
static
4硬盘诊�...an.exe
windows7-x64
3硬盘诊�...an.exe
windows10-2004-x64
3硬盘诊�...SL.xml
windows7-x64
1硬盘诊�...SL.xml
windows10-2004-x64
1硬盘诊�...SP.xml
windows7-x64
1硬盘诊�...SP.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...RT.xml
windows7-x64
1硬盘诊�...RT.xml
windows10-2004-x64
1硬盘诊�...SI.xml
windows7-x64
1硬盘诊�...SI.xml
windows10-2004-x64
1硬盘诊�...ST.xml
windows7-x64
1硬盘诊�...ST.xml
windows10-2004-x64
1硬盘诊�...al.pdf
windows7-x64
1硬盘诊�...al.pdf
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 10:22
Behavioral task
behavioral1
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win10v2004-20220812-en
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
-
Size
4KB
-
MD5
584d0ffcd85432f790e3788da5ad5b65
-
SHA1
5a59eff5cca1fc87cf22319d5a703ba7bf19839a
-
SHA256
5b9076a0df8215cc091fd9472ec5265b9816c4729578f70868d0c55fc4507c89
-
SHA512
2a1053f7916c9cc637246e737a7b25cf4189533c25b6eeb43a96270b6e5c4c93b1289df5e9606f3b49fa2bf62319fe4d73d0c00036561d5240d1d67a4253b814
-
SSDEEP
96:w0mvSlhCuUpXAqVpMA+1sq/vMRurJQXAqVpMA+1I/vMRuG:w0mvSlhCuUhVpw1s+v6urJGVpw1Av6uG
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d91200000000002000000000010660000000100002000000034b8e8250abb5c840d3fa1c75cd49fa7c09b4fa74875ade18953d650515525e4000000000e800000000200002000000076151063e4f3c8dea8d69ce4ff29d2465cdec725b0f44a949ce6c5517afb667d200000004486ac71f0c96483d042380dbbf1f24e5bebbc5a7a24b774ec9a0d7760b8edc140000000fe312f01d9391887443e34f8f80787703ea7c80f03b288a0053fd7cb3f6cab7dc125abe067959e43b7304555505b255bc74233a9b0c4b57f3d55c05071c81011 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06c244411e6d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1081839460" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991889" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991889" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366490491" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991889" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cb134411e6d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B9F96EB-5204-11ED-AECB-E62BBF623C53} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1109495766" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1081683572" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000e13930ce8bf3fe11912e5affa6e8cd69673059d19f7da253303cfeba388ed901000000000e8000000002000020000000c2460cfba02e673bba994bf9f5ade61c5c52af78311105d1895a3770ce2bd11420000000f9719851f8eaddd3ce3e3219d670dbe95af7eadb62d6bfd9cc8366dc1576eeb1400000002b50edfb5a8f8f21719805dcf55668a77b9a982d23cc0eac44a72abdd717e39d9a5b56a7ab66563eaf303c71c056da9a90c44b0e257f32cc1fe311e55715efc2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4968 iexplore.exe 4968 iexplore.exe 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4244 wrote to memory of 4968 4244 MSOXMLED.EXE iexplore.exe PID 4244 wrote to memory of 4968 4244 MSOXMLED.EXE iexplore.exe PID 4968 wrote to memory of 4736 4968 iexplore.exe IEXPLORE.EXE PID 4968 wrote to memory of 4736 4968 iexplore.exe IEXPLORE.EXE PID 4968 wrote to memory of 4736 4968 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\SCSIID.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\SCSIID.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4968 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD59ebd067ed9097e52468ed43389e20f84
SHA1254e9e98e444f9aa5025e9f39d26c2ee6343b070
SHA256c2f13a89d711a444d9e2e5a909191abfd3b00b1c73d8b6b5d8f9df8eaa5f8bad
SHA512a70df9fc2fb4ffd351c4702d5b7dfda2f5b96b3596d53f09f981afce933a53768c940dc04e93b0098f5d2a309919d6b3a4398bb03b8bc5aa67c4ac7dff525c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD52effd0adb729c94e4c81893d31244f9b
SHA151abc2d57bd94418ee69361d5575ac8abc33397b
SHA2568a6196f0494e0be941b21c2c529ef09965e83abf4f24d4ecd176a23446d8c405
SHA51215cf4494e700fca305210b162184ce491e43460aaaa8d87d82cc939ca57b1cdb32c8c3aa2f10deec40b480c047bdd84e603b47ece3235a4a413f2198a4096510
-
memory/4244-132-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-133-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-134-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-135-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-136-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-137-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-138-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-139-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB
-
memory/4244-140-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmpFilesize
64KB