Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 19:06
Static task
static1
Behavioral task
behavioral1
Sample
0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe
-
Size
1.2MB
-
MD5
0e37dbc17b52f40bec09f8e984b766f2
-
SHA1
72ff7380dc31ec0dbbe3a08c32ae5e2268d98398
-
SHA256
0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37
-
SHA512
15948ead22d8bfd14712fb86a2ab6b55f766e50be5eac750c05c62c452d1efc23eeedfadebef0d4898ceadd69be3fd837450f64ade25e89e4c56f6c3b02b7869
-
SSDEEP
12288:EaJmCEtQUKKGpOdn6HZqpR+oklRnAnvcvcx8nFGS13z81uoQb3WDb:E6mCEaiGcd6HApR92RnAsFGS13zrGDb
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File created C:\progra~1\ico\$dpx$.tmp\c035bf7ac0ba11479cfed905d3ac7e91.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\6a9b31699e1d394bb02727700197cd9b.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\e1a871fcfd1fc747a596117ab2060b23.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\dc5e71089fe10c4ba26948b36e733991.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\028955107507514ba08e4830662b94bf.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\b250ad8bc2b27948aedf33064a9281ee.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File opened for modification C:\progra~1\ico\meiv.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36C39F11-5F6C-11ED-BBEB-FA28CBED7ACF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08f821579f3d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374680364" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000029a1016a51eb4a945496db6fe2d837506ae7c0562bc7c8247515f93fa402b543000000000e80000000020000200000007f99c284c0643e9804bf353d435e91707068399bd720a782b5f6e5f66095e3fb900000000186fff8546f737906833c78a5f15e6e9afc616fe49b6972d8c43a3d092eb954e60f3a2562c2749b4ff913e6a3ed43cc9d68b90f8b50da1cb06625f9da01d24ccdd96f2a32c1024ca83fd681720b3b24b40e8b411bb07405ba30b3cb2788ce7afd8d2fa4568ae934b500277fd204158f307efc12012bdafb65c465e8846f4b1a256ac97c9fd998e7258411d2570100c04000000003786c70fd8dab688d5c11332bf2bbc9908d2d02890371a275b47dc7c22d235faa01fe5e9c8baf494d7bc7648f5af4f5afac2e4ac0dd2191567a9d8df9252915 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000a9f20be79825be58df6154950ae15e4547f0765cb75468e4d47f9f6c0b4088f7000000000e800000000200002000000024fdded5667d90a27ca3ef3949cb39f11c78934ca8af2c2a76bee85668fca403200000003b01e14b1b3f69ddd85ec18474030a2db092dd3d25b5d9ae80f4c1f03ef0398340000000dc7bb17d7eed443a67e963f5a8bd38c0f8eadfefb67962e1333efc3ba01c5ef97b7064ef440bd609a8c92ea99f81324d7f91e29b3cb0522c139e7c5866dd9926 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 1928 iexplore.exe 1928 iexplore.exe 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 992 wrote to memory of 1980 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 28 PID 992 wrote to memory of 1980 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 28 PID 992 wrote to memory of 1980 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 28 PID 992 wrote to memory of 1980 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 28 PID 992 wrote to memory of 2024 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 27 PID 992 wrote to memory of 2024 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 27 PID 992 wrote to memory of 2024 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 27 PID 992 wrote to memory of 2024 992 0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe 27 PID 1980 wrote to memory of 108 1980 cmd.exe 30 PID 1980 wrote to memory of 108 1980 cmd.exe 30 PID 1980 wrote to memory of 108 1980 cmd.exe 30 PID 1980 wrote to memory of 108 1980 cmd.exe 30 PID 1028 wrote to memory of 1928 1028 explorer.exe 33 PID 1028 wrote to memory of 1928 1028 explorer.exe 33 PID 1028 wrote to memory of 1928 1028 explorer.exe 33 PID 1928 wrote to memory of 1568 1928 iexplore.exe 34 PID 1928 wrote to memory of 1568 1928 iexplore.exe 34 PID 1928 wrote to memory of 1568 1928 iexplore.exe 34 PID 1928 wrote to memory of 1568 1928 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe"C:\Users\Admin\AppData\Local\Temp\0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\hFoUP.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:108
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
603B
MD56d85f78969e97b5bccc652c5032dccc5
SHA12588d1750d11fe12caf7b71c20dacf0f40f27202
SHA256c9b0ec084d0ebfb4d0b0111f49fdf7d8d46a46cd7907133d3932efda6ca5b16e
SHA512d09aa7135f63ea9cb2a65d46e9803afd77faac3d0c36607e7abdf376457634d226ce50e05af8648e2d5a869d7e0e548adea4636d3639f00524539517ca75fe51
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f