Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 20:39
Static task
static1
Behavioral task
behavioral1
Sample
b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe
-
Size
212KB
-
MD5
5413dcbdbb2bd0d88776a31b83b11037
-
SHA1
6e1f42b7256b8f5567154a320e2d8407a055ba4f
-
SHA256
b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c
-
SHA512
821eb0886078520af1059529d92d820a58aee8c1f647198418fa09d569da2b6d8faf60c19bc558ac17d4aafa7ce4105ccc8e5f82c8320bd1393889578bca9161
-
SSDEEP
6144:dcyyU/A5rZRLEhFTnRa26s+Wdz8V7Wdfwn1nbmuSDm3:dHp/urb4A1WdBfU
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4832 Program Files1136EH.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\t.ico b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe File opened for modification \??\c:\Program Files\Common Files\d.ico b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08f0aa821ecd801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993441" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373873184" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000b85de1bf6b15e3c7e6a56a78276391a6ca9d9e9170d3fc4d88d5921c4bd86f14000000000e8000000002000020000000578bced7063b1ab6951b887c3672f051e4e8f0055be55915c8bce534293d7e5f200000008d01598ef2c00865f2a6eadf941bf6ca57e48d84d6a95f64970c0cdd8a5d2ed540000000de4459fef86729d4217638adca495367968b48b2db8fa326c3ef71c3f503bf6ef2e06e859e26e500968b9119d32a44604ff359a46236fdb7cfaf4f8f64cc35d5 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a3d7a821ecd801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2964113337" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D04B8F23-5814-11ED-89AC-EE6CABA3804C} = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000a485c3bd05029124aa05d64823d0609590e0382885eda6c22424f9637aea7d38000000000e80000000020000200000001d4b7fbb84574dbc888e4319a67e54a4c8f712dde0ef19f33b9464f3324f91122000000000b7c32b9535f0c93a7ce39caf9c2b00d2d71d1d2d4102132978f010a3a97d794000000077b3cb17aea86619a7e3c7b76ac2d77f7c91ea54f24ba06ce76258dfdc2d3dafbcb8bf5a45b7d8e0d431ca497bda01d5bc03a64f6e76024b128c7dc32ddea486 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993441" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2964113337" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4044 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 4832 Program Files1136EH.exe 4044 IEXPLORE.exe 4044 IEXPLORE.exe 4288 IEXPLORE.EXE 4288 IEXPLORE.EXE 4288 IEXPLORE.EXE 4288 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 848 wrote to memory of 4832 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 84 PID 848 wrote to memory of 4832 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 84 PID 848 wrote to memory of 4832 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 84 PID 4832 wrote to memory of 4044 4832 Program Files1136EH.exe 86 PID 4832 wrote to memory of 4044 4832 Program Files1136EH.exe 86 PID 4044 wrote to memory of 4288 4044 IEXPLORE.exe 87 PID 4044 wrote to memory of 4288 4044 IEXPLORE.exe 87 PID 4044 wrote to memory of 4288 4044 IEXPLORE.exe 87 PID 4832 wrote to memory of 3012 4832 Program Files1136EH.exe 88 PID 4832 wrote to memory of 3012 4832 Program Files1136EH.exe 88 PID 848 wrote to memory of 872 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 89 PID 848 wrote to memory of 872 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 89 PID 848 wrote to memory of 872 848 b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe"C:\Users\Admin\AppData\Local\Temp\b1fc90cbed47c7c7e8db6ca4c567b23a3a2d783f4f88778da5492620f2b79f3c.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\Program Files1136EH.exe"c:\Program Files1136EH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4044 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:3012
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:872
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD55cde50eb9ec1f82f94d6b66080b9d594
SHA1bebe644200a53fc69c73105fe7ca2c43af636dff
SHA256f31ef65e3e2a89a9c87ed0145d5c0ce85a33b033e30f8e74bf0ef3c6d59d893e
SHA512b52484ce740cf74a0f76661562858dec6e29b5119c69b22ed1ff918c287a6c63b8b2a782823c8f21e92a5b0f21b37f750c843d277d7373d4e684392a0e5bf309
-
Filesize
486B
MD5daa9cfa3312a0b4dc5e2db91a9aff4d7
SHA1f5415f2e5e05042fa58db71a4b854c94d310c098
SHA256bec9a0016f0a4ed336e28efaba8fcbe2216b62d59808f4c12cf74f6d4819fa2d
SHA51275f70350a5e5f3ef62a539a094ebc9f3de38673a9080aa0c9c28bbe91ad9ecc6a6550f9ea1080314d86fba336c82b8de494ea01452ef77b54660187c716b5483
-
Filesize
36KB
MD55cde50eb9ec1f82f94d6b66080b9d594
SHA1bebe644200a53fc69c73105fe7ca2c43af636dff
SHA256f31ef65e3e2a89a9c87ed0145d5c0ce85a33b033e30f8e74bf0ef3c6d59d893e
SHA512b52484ce740cf74a0f76661562858dec6e29b5119c69b22ed1ff918c287a6c63b8b2a782823c8f21e92a5b0f21b37f750c843d277d7373d4e684392a0e5bf309