Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 19:49
Static task
static1
Behavioral task
behavioral1
Sample
5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe
-
Size
308KB
-
MD5
02de132e50973a1217dffc0f67fcd865
-
SHA1
a61ca76ef1d61e18d23245ebd72059ac8b2b6bac
-
SHA256
5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a
-
SHA512
b57d4241dc71ee7d9f75b435a9525fb0734b85e6ac257067fb706315f02e94ffa3f5c1734faeacba66bad115764a4270e55439e0af983f3ce84df4f916bb3205
-
SSDEEP
6144:n9Ufckd8VjhiAn4ORc4zCvVRsUz2olv+YXaht8+ajFfP2F/kg/xzetmh/:9NkQuvdRsUaolfaht8+UdRgJumd
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\4d2b22a0d39741419d1e2ccb2a275e26.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\8bbd8ca47c04674d8f0aaf7d47d3fa10.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\04fdd8d4de71ea47a6a19b84759f18ab.tmp expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File opened for modification C:\progra~1\ico\Music.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\fc57e7012bc8b0468fd2c7b94a743b78.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\4b6467816137d94c983eadbb335fc556.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\3cb9d847d39498459ad128d89911ce37.tmp expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000b35a68262922995c32ecdde1ce579b3d852dee99878fb1db7cedf958a8ae8419000000000e80000000020000200000001403d42696abe636d7a37ce9c6d62d457c8a53f1164c66498cc33081f421058d2000000062d53158e49850f0a6b6cd5f9263d1a7f821240fb7b3cc11c64d8556a3e0abd440000000a67515a5e348825b883bada18ee3b6370e6ff8fffa878c86b75cb79f4ea281062a275c31a373d0a94559b62dfdd24984e714248dbdaffdabb4fc760a2705dcc2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000ae338d705bcf041129cc90588e32ffe1377d6bc3beb0d22469c54b1fbd167d9d000000000e8000000002000020000000ac5f37a70a59f0e0cf47f8d15b9d7f4687bb2d8c4b5badee73ffac00527844dc90000000ed959915a0a9c736a1736e7bef12bc8c1c2a881ed532bff5225843ec4ad4a2d53aeb0956c533208dea312e6f6c33c08c3810ac0a8db8d78a95dc31f529a9f9f03414fe0ea04e3f84fa265c9fdbb2163e9ca6cf204f49edf289043e1730a4772054724813209707f0771d954bf5900984f51ad47a46e57e8b15c2d45dbb69e1515ae9c25b5c4a2d066fe6ca6ced7d43ab40000000d2c21d5539989d2530598d0ec4f44e61fa6a44249d2b6b71e4b706924369f7e8d57c65aedee5461aceea2eb0bfaf26a73214dd2b71793cafc0822c57831ab3d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374688224" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CDCDA41-5F7E-11ED-AFAE-66397CAA4A34} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103adc5c8bf3d801 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1164 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 1164 iexplore.exe 1164 iexplore.exe 688 IEXPLORE.EXE 688 IEXPLORE.EXE 688 IEXPLORE.EXE 688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1564 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 28 PID 1980 wrote to memory of 1564 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 28 PID 1980 wrote to memory of 1564 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 28 PID 1980 wrote to memory of 1564 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 28 PID 1980 wrote to memory of 2012 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 29 PID 1980 wrote to memory of 2012 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 29 PID 1980 wrote to memory of 2012 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 29 PID 1980 wrote to memory of 2012 1980 5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe 29 PID 1564 wrote to memory of 1552 1564 cmd.exe 31 PID 1564 wrote to memory of 1552 1564 cmd.exe 31 PID 1564 wrote to memory of 1552 1564 cmd.exe 31 PID 1564 wrote to memory of 1552 1564 cmd.exe 31 PID 1184 wrote to memory of 1164 1184 explorer.exe 34 PID 1184 wrote to memory of 1164 1184 explorer.exe 34 PID 1184 wrote to memory of 1164 1184 explorer.exe 34 PID 1164 wrote to memory of 688 1164 iexplore.exe 35 PID 1164 wrote to memory of 688 1164 iexplore.exe 35 PID 1164 wrote to memory of 688 1164 iexplore.exe 35 PID 1164 wrote to memory of 688 1164 iexplore.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe"C:\Users\Admin\AppData\Local\Temp\5566d02e2d12620eae12646f88b90e6e496ece50a8dabb97abfce4ef9b79b13a.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\75IE7.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1552
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:2012
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:688
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
608B
MD5d3fbbcb64ab9e2bab147c5d392c40601
SHA14279a8b65120ed735c16429f9a9fdb6a3d79c818
SHA256b40af2d922cb798061bcadbefeb3ab7396cc4932208dbf5449739cef1dcdfabe
SHA51268a4e5ea91d7f299f3cdd6190a090dee3ef7da619070677c6f127596a83aa8cdec0ccf47b402c93f8760f64008c35a77913cb2ace91035ad006819d9d3016412
-
Filesize
18KB
MD5f462d70986dc71a5ff375a82bd9e3677
SHA1f3d9c09a0ff51d81377e15ae4e0e2fceaede142b
SHA25669528b0fb4e1bc3fb8d92839d98e0717b3f680d98fdfcb9809a2f557aacab295
SHA5125bd2d67bb78dc8c4275390667c135ed10c4733e46ce58ef524ea79869f740db00d2f4a37b949896edcbf1ebbfa1ab4dd16afab4418ff637322883435bb7543ec