Overview
overview
4Static
static
4硬盘诊�...an.exe
windows7-x64
3硬盘诊�...an.exe
windows10-2004-x64
3硬盘诊�...SL.xml
windows7-x64
1硬盘诊�...SL.xml
windows10-2004-x64
1硬盘诊�...SP.xml
windows7-x64
1硬盘诊�...SP.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...RT.xml
windows7-x64
1硬盘诊�...RT.xml
windows10-2004-x64
1硬盘诊�...SI.xml
windows7-x64
1硬盘诊�...SI.xml
windows10-2004-x64
1硬盘诊�...ST.xml
windows7-x64
1硬盘诊�...ST.xml
windows10-2004-x64
1硬盘诊�...al.pdf
windows7-x64
1硬盘诊�...al.pdf
windows10-2004-x64
1Analysis
-
max time kernel
102s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-10-2022 10:22
Behavioral task
behavioral1
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win10v2004-20220812-en
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
-
Size
7KB
-
MD5
e6edd57a6c6bdab838e8015fcebabcf0
-
SHA1
7755f9c9ba7e7ed81e5cef4157b576608e5eb0d1
-
SHA256
b3d5a68267da3f3ac4d029c9e669d006f2ac6889066af1e199146dc267029790
-
SHA512
676070d491bdf18b0827bb3260c73de475f83e23095265dfdff8a97da580ee099a9ee01184bdeabb9c0d02d57c030e46af6bd2b87ebcc270da1574c1a629b8ac
-
SSDEEP
192:FH1vSSl8dllhCu3E3Eu1svzJ8d5djBIwR:FH0Sl8dllhCu3qZOzJ8d5LIwR
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75EDE081-5204-11ED-B2BF-6651945CA213} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d008904c11e6d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373206468" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000782dd49672dd0acaf137390c3efcdd403d15e40c8014c3f77916222325354bf6000000000e8000000002000020000000e46fac5be42a4fb8105c29bd357ee89961e0f87241c213156eab31b24c6fd57b20000000a7df47d14f56b19b8f9fc4799b131b5380d5b1e2992af7477d0f01026de3e13b4000000038e669fa295a78a4fbf2c5743b95789c2a8c71ab539a90a6adfe6607faf14f07b349f6d1e5cd29e541e207df7f02161fe4867408473b5c3a2ac32268bfadc12a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000005b1c7832cc294215fe616230f59557df31806356508eae34ec3e3ca712019ab7000000000e8000000002000020000000d53e6330c7dcf835217486a5e5b1a6c7dee6d7e551a9abd999fd9cc439420c8d90000000025fd1409515f97347f12c0adb53eb0ecadcce7cb51c936783cd85dd8a072b10424d2f115dc4e081f548f3ef3a42893b008ca1950634ec59fc5c7b6b860e6da30bf92830d4eaf75c320670d05a2970183c79a319a3fd1f47ebd9aa05a0cb80bd491587ab68f2430974427561c9889c7fe6c9013e7b191b13504ea4ffea9eb66af78cc100ed0e7f8b948311d5d77589bd40000000a5d7a646c3e8545d63751179c6f13bdf716c7c65f80451faf845af807a0e25ce4034fbeff755f61cba0ffe77c4741ccef22b6f86af181f211858edf7daf31423 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1348 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1944 wrote to memory of 1148 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1148 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1148 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1148 1944 MSOXMLED.EXE iexplore.exe PID 1148 wrote to memory of 1348 1148 iexplore.exe IEXPLORE.EXE PID 1148 wrote to memory of 1348 1148 iexplore.exe IEXPLORE.EXE PID 1148 wrote to memory of 1348 1148 iexplore.exe IEXPLORE.EXE PID 1148 wrote to memory of 1348 1148 iexplore.exe IEXPLORE.EXE PID 1348 wrote to memory of 1216 1348 IEXPLORE.EXE IEXPLORE.EXE PID 1348 wrote to memory of 1216 1348 IEXPLORE.EXE IEXPLORE.EXE PID 1348 wrote to memory of 1216 1348 IEXPLORE.EXE IEXPLORE.EXE PID 1348 wrote to memory of 1216 1348 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\SMART.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BUFM599M.txtFilesize
608B
MD5b4ce0b6ddac60a05e529217cd8eea737
SHA15318858d6b368a5b2b2ab25aca11c70c0243f914
SHA256103e2162e893208f35359480e07d9e6077b37d9c42c814aea396ddabd5dc5509
SHA5125cc9787f6c5de811ac7c72179e9fe93c8c29649377d695cf8862683d06e74426793e4ceaf21c775ab572b2e434043af61517797d9396d201506aeeac456f04e3
-
memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB