Overview
overview
4Static
static
4硬盘诊�...an.exe
windows7-x64
3硬盘诊�...an.exe
windows10-2004-x64
3硬盘诊�...SL.xml
windows7-x64
1硬盘诊�...SL.xml
windows10-2004-x64
1硬盘诊�...SP.xml
windows7-x64
1硬盘诊�...SP.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...RT.xml
windows7-x64
1硬盘诊�...RT.xml
windows10-2004-x64
1硬盘诊�...SI.xml
windows7-x64
1硬盘诊�...SI.xml
windows10-2004-x64
1硬盘诊�...ST.xml
windows7-x64
1硬盘诊�...ST.xml
windows10-2004-x64
1硬盘诊�...al.pdf
windows7-x64
1硬盘诊�...al.pdf
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 10:22
Behavioral task
behavioral1
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win10v2004-20220812-en
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
-
Size
7KB
-
MD5
e6edd57a6c6bdab838e8015fcebabcf0
-
SHA1
7755f9c9ba7e7ed81e5cef4157b576608e5eb0d1
-
SHA256
b3d5a68267da3f3ac4d029c9e669d006f2ac6889066af1e199146dc267029790
-
SHA512
676070d491bdf18b0827bb3260c73de475f83e23095265dfdff8a97da580ee099a9ee01184bdeabb9c0d02d57c030e46af6bd2b87ebcc270da1574c1a629b8ac
-
SSDEEP
192:FH1vSSl8dllhCu3E3Eu1svzJ8d5djBIwR:FH0Sl8dllhCu3qZOzJ8d5LIwR
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0eac56211e6d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991889" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373206468" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1833863552" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991889" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1833863552" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000071e47c81d4b8e4799b8212ffd899ab0f7b4966f715c1d7517cee993ac0d65ebc000000000e80000000020000200000000ca26d392dc2c8be74a963ef00774a1bc453288bb9911c83dedfce7ef2313c8d2000000075da96edb523f760bb86af3a3e331b5f79b7e851241d6e267e6b9fc7e857647640000000721cdae3f2062e5402b8e53640ecd75ef41fd37f4edc30f6027dfb1f176b5574afe155635fdf9401b90dafe9bd2a791aaba7b3dab33b253e4b9ab681dc71bcf3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000d69cd48b09eeba17b426122d1d08771951911f8e5465cc53ae05ca173c265c81000000000e8000000002000020000000836dfd2ab09d159837cf47166aa0996c7e53b80f2d5ca37fdad0da96e393e22320000000d6c979d7eb3d0e06992a066953f0f65fbc2b2f2ab26632d6a21628f1c86e742c400000006e6297165265ca7b8e1726195f18ff49176ac047ba7fc66a336a65163ac620d4b417a73cf25ab556dd3e6f1f2ce97fd7277de4dd0870db4cac72c32ed4ad0096 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7D837A75-5204-11ED-B696-E62D9FD3CB0B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03f255b11e6d801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 5016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 5016 iexplore.exe 5016 iexplore.exe 4652 IEXPLORE.EXE 4652 IEXPLORE.EXE 4652 IEXPLORE.EXE 4652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4108 wrote to memory of 5016 4108 MSOXMLED.EXE iexplore.exe PID 4108 wrote to memory of 5016 4108 MSOXMLED.EXE iexplore.exe PID 5016 wrote to memory of 4652 5016 iexplore.exe IEXPLORE.EXE PID 5016 wrote to memory of 4652 5016 iexplore.exe IEXPLORE.EXE PID 5016 wrote to memory of 4652 5016 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\SMART.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\SMART.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5016 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4108-136-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-135-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-134-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-133-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-132-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-140-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-139-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-138-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB
-
memory/4108-137-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmpFilesize
64KB