Overview
overview
4Static
static
4硬盘诊�...an.exe
windows7-x64
3硬盘诊�...an.exe
windows10-2004-x64
3硬盘诊�...SL.xml
windows7-x64
1硬盘诊�...SL.xml
windows10-2004-x64
1硬盘诊�...SP.xml
windows7-x64
1硬盘诊�...SP.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...ID.xml
windows7-x64
1硬盘诊�...ID.xml
windows10-2004-x64
1硬盘诊�...RT.xml
windows7-x64
1硬盘诊�...RT.xml
windows10-2004-x64
1硬盘诊�...SI.xml
windows7-x64
1硬盘诊�...SI.xml
windows10-2004-x64
1硬盘诊�...ST.xml
windows7-x64
1硬盘诊�...ST.xml
windows10-2004-x64
1硬盘诊�...al.pdf
windows7-x64
1硬盘诊�...al.pdf
windows10-2004-x64
1Analysis
-
max time kernel
90s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 10:22
Behavioral task
behavioral1
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSL.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/IDEID.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SCSIID.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/SMART_SCSI.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/TEST.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/User Manual.pdf
Resource
win10v2004-20220812-en
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/res/DEFECTSP.xml
-
Size
4KB
-
MD5
4d9ed29fa0132971056d8f3d14f0ed70
-
SHA1
27f5f087c50add13145b36799eec7d7b12ab2a4e
-
SHA256
71c20fc32bd3eba6f9ae6854bb8a57e83dbd5666a561ae73ab6429788dedd5c3
-
SHA512
1c848fde568e1e3a4b8ffe328cfd097c6fab8455e24329c78da02157ce2c738af73542b5ce219adfd5be27255088387e27140700760b8eab5c4d73bc24c5275a
-
SSDEEP
96:biMR1vSlhCuqDYXA4MASjAIjA+ZrDZMPMAaMTsr4:biMR1vSlhCuqD0YztZnZWcOsr4
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7218C5F2-5204-11ED-89AC-DEF0885D2AEB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000007abd93161f0ea8a3afe1d047e3210dcbcde4280b93eb1b37e3ab186a34c76581000000000e8000000002000020000000660ccb10c5fa01bfb1d039e4a5752b70952453eacf2de5e7bad8ec64e63908d6200000006aa52b0973046e6557611d2e478e3dc97f4acd5446d678e93edd07818cfadcf94000000048ccac8e933b7fcd34475652065134b59fcad6f8557a5b36f143925dfff23db22fb64d961e671dda75665681c4dc9802db90588ee566727037a72854baf8be4e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991889" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991889" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991889" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373206449" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1239195451" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000f6e08db339e734871879d64f9bc3f7ee3ce46786535b14ec64fedf7ac082cc33000000000e8000000002000020000000b2dc2f322f097e7797a89c00bd7364ef35c1d2fb8ef348194404afb801d2386f200000007688b423c4918d61769c1a039194e92927d685addb4179aade3f944a6b79631640000000d329292a01322ed10d40f7f32ecfebdd5f5f4fe6791a35b25f8c0c9aefef7e8790e43a4d282821697d6f1ad6dea2ea0609eca5d51b93ecca4a3a1654a7726ced iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1239195451" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1285759239" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d042c24911e6d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991889" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d55d4c11e6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1285759239" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1652 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1652 iexplore.exe 1652 iexplore.exe 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 1336 wrote to memory of 1652 1336 MSOXMLED.EXE iexplore.exe PID 1336 wrote to memory of 1652 1336 MSOXMLED.EXE iexplore.exe PID 1652 wrote to memory of 1412 1652 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 1412 1652 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 1412 1652 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\DEFECTSP.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\res\DEFECTSP.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD59ebd067ed9097e52468ed43389e20f84
SHA1254e9e98e444f9aa5025e9f39d26c2ee6343b070
SHA256c2f13a89d711a444d9e2e5a909191abfd3b00b1c73d8b6b5d8f9df8eaa5f8bad
SHA512a70df9fc2fb4ffd351c4702d5b7dfda2f5b96b3596d53f09f981afce933a53768c940dc04e93b0098f5d2a309919d6b3a4398bb03b8bc5aa67c4ac7dff525c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5de9699aec30fbdaddf0699df5eb1136b
SHA1b4e00a80813b593c1148a0d25e47934dd3a541b1
SHA2569a8fcf46609e0bfc53bd206d64d6ce45be43dd51f96c4f0d2e83658e8965f87c
SHA512cddc6fd556ae15b9c2a74cb50f579887757dae29430429ac0b3ad48027d0084d834deb7baa08c29d66c90d30529dbdd897db2736bab6c2a2c4745c64ceadc91f
-
memory/1336-132-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-133-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-134-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-135-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-136-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-137-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-140-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-139-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB
-
memory/1336-138-0x00007FF892150000-0x00007FF892160000-memory.dmpFilesize
64KB