Overview
overview
4Static
static
4硬盘诊�...an.exe
windows7-x64
3硬盘诊�...an.exe
windows10-2004-x64
3硬盘诊�...SL.xml
windows7-x64
1硬盘诊�...SL.xml
windows10-2004-x64
1硬盘诊�...SP.xml
windows7-x64
1硬盘诊�...SP.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...RT.xml
windows7-x64
1硬盘诊�...RT.xml
windows10-2004-x64
1硬盘诊�...SI.xml
windows7-x64
1硬盘诊�...SI.xml
windows10-2004-x64
1硬盘诊�...ST.xml
windows7-x64
1硬盘诊�...ST.xml
windows10-2004-x64
1硬盘诊�...al.pdf
windows7-x64
1硬盘诊�...al.pdf
windows10-2004-x64
1Analysis
-
max time kernel
132s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-10-2022 10:22
Behavioral task
behavioral1
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win10v2004-20220812-en
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
-
Size
2KB
-
MD5
471460c3f199ce55f35112006012e82a
-
SHA1
e5b6771bd1185daba857f69bb0e3a4958f7cc0b1
-
SHA256
a71766a26fbe1ce8c80ffa50946df0a75a6dc37ac75aad560d683b25a22a42f4
-
SHA512
d3c62bdc5125f81b943d519e8a4c9930b98eade41f54c5d6dc6a0877e390e8e0ccccb03b369f69846c4a1255467233e8022956a5e19a8a612ae6184afd5021fc
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FC72FC1-5204-11ED-8B2C-72E6D75F6BEB} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80371e7b11e6d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000ee6350ed6d9927d7a4445c9c4419e0779e6bd172d3dbc4be1f6cc1f081b3c720000000000e80000000020000200000001c3cf155f4d040b923561e946be76c56a7e0f327531d8764d5354105d58bb39620000000fa74c9f745f974327fc3baceba740cd0cfa4dbcb76870bcea0ba8407637e4b6440000000b73bf2eb0c17885189e5449c8898cb211f7996ff1a94bdc02488f52604886b38ba43bd1cd798b42632971dd5d3226b774c010e0098e9a45ae47355d6a6ee757f IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373206513" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000ac13f1bbbe9cbc14c14d1d758faf2d9cdc9cfa94162e4182427b176e26a0186a000000000e8000000002000020000000a249e21233648cea888dc0e4403c04dd80b5449931dfef1ad559142016d0750090000000e37553aebcc126085596185f891343a66fb15bd89e09e3c8373271d55c909fb4e5ed971fd27fdf6afb379fa37e3e4ddeeb586b9e45ed4108f059a506bb93107c5663e321891ae6f610ac635a47907018cc53464c99f011b90dd57e4bf2f41a1eab3687bbe4ee07617e3d5d7e1c6ecf7d531e53589b2ad7e7b4478e31e12435f0b614369757cc3fed09a5ea5cb56cf7734000000095c32a3f436cf7a4d1f3d6823492227ac8431fdd7de57812acb4335bfb65a447e076d00e35eae774e1172c3c310ccd5d2e35993ff55dd5a53800ce8c49b7a528 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1448 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1388 wrote to memory of 1224 1388 MSOXMLED.EXE iexplore.exe PID 1388 wrote to memory of 1224 1388 MSOXMLED.EXE iexplore.exe PID 1388 wrote to memory of 1224 1388 MSOXMLED.EXE iexplore.exe PID 1388 wrote to memory of 1224 1388 MSOXMLED.EXE iexplore.exe PID 1224 wrote to memory of 1448 1224 iexplore.exe IEXPLORE.EXE PID 1224 wrote to memory of 1448 1224 iexplore.exe IEXPLORE.EXE PID 1224 wrote to memory of 1448 1224 iexplore.exe IEXPLORE.EXE PID 1224 wrote to memory of 1448 1224 iexplore.exe IEXPLORE.EXE PID 1448 wrote to memory of 904 1448 IEXPLORE.EXE IEXPLORE.EXE PID 1448 wrote to memory of 904 1448 IEXPLORE.EXE IEXPLORE.EXE PID 1448 wrote to memory of 904 1448 IEXPLORE.EXE IEXPLORE.EXE PID 1448 wrote to memory of 904 1448 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\TEST.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6KEL1V89.txtFilesize
608B
MD52cedb42e9e5302c83e738c18a3b221ad
SHA1acbefb7df51904db34651526147e4c2d6d2f25c5
SHA256fdcc53a6648564c1fbb5ec706ec5e0e28b76468dcb3e95ece244b81dd50e4f86
SHA512a3726b12bbba2ccaad9161ddd7676be1847144b87fccf6a054b05594eed1474611c200b262d8f828b644c6eab61726cd97eac0bb927a516cae3a30978da71689
-
memory/1388-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB