f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f

General

Target

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Size

208KB
MD5

d770b3b7796bbf4caca7d8885cddf5a7
SHA1

6278c627b967a0f46201cd77e48338d7061271c8
SHA256

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f
SHA512

69c481f6227854cfb6c43d7a5ed1324f3d1fe4964a40b52e7549d5770c7b481f1931e76f8251edefb3fef9be60dbf81b9b6e74ce9509b3b66b5c350410215f2d
SSDEEP

6144:gc7/0wU6orOacpyXaDmlc0IuQM97WfMbeRmDmq:gdwU6oXcaWvv6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Program FilesHH5V34.exe

pid process

308 Program FilesHH5V34.exe
Deletes itself 1 IoCs

Processes:

WScript.Exe

pid process

1944 WScript.Exe

pid	process
308	Program FilesHH5V34.exe

pid	process
1944	WScript.Exe

Drops file in Program Files directory 2 IoCs

Processes:

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Common Files\t.ico	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
File opened for modification	\??\c:\Program Files\Common Files\d.ico	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.exeIEXPLORE.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E680311-6B23-11ED-BBEF-F2255ECFD43B} = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000179c6ee502b6c677bab839e1993c1d4bbe1c84baad01556ecdb3e06b282766c0000000000e800000000200002000000000ce2917380a99c232b73b07b7da906e1acb94a320ce3738319b1861f828b8b120000000e3f5e6e5c489e42854830a46f961de8c28d5d495d6441d117c88e6707006a4fe400000008c6b41fe4cdcdae1b1843ebe665e6f33850b5120a63f0937d89e3f2768bff0d4e05994a8851e0ead98b814147ebaf25a7f720d81f4c646feff523da60eb6da3d	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b4ff6c30ffd801	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000641efad1f3a20e5084380d0a3c1cd9399bda0971e12b9db8270ec65f0c753e5b000000000e80000000020000200000005278e17d3aa187d3d6597aa1b03ebf0d74bc3cf8911bc39196eed5c15c5576bb90000000240ce51834cdadddcffaa866c58782bc1a4999c68e3c8aeb6f1e65fc6f3578de09cf934ba6d58a695d0da5c8909902c1ee22f6520f45f8fb6e2bd63268ed136c64c7bfedf8dcb87e190cc0f8f27f79bacab41b5026b298e5d24e31b16020dcaa58e73ae643bda09b0e599b31d90b2edbf97638b7bb61498f44c3ad16c274880010e8cd07ce32dee0677fc07c7e3a045c400000007ecb74b5b24cd44b12043d4cf539f4bf27f20e9c16e3300ed43a6f997b988796d8f29248b89cc418997fe0ff280690e21cba5bf548059b78f9bf5fbdde5b6584	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375968573"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E99FFF1-6B23-11ED-BBEF-F2255ECFD43B} = "0"	IEXPLORE.exe

Modifies registry class 60 IoCs

Processes:

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hli	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hpf	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hyx	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hdh	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htb	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.35yes.com/?1121"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.h35	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130"	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

IEXPLORE.exeIEXPLORE.exe

pid process

1656 IEXPLORE.exe
1388 IEXPLORE.exe

pid	process
1656	IEXPLORE.exe
1388	IEXPLORE.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exeProgram FilesHH5V34.exeIEXPLORE.exeIEXPLORE.EXEIEXPLORE.exeIEXPLORE.EXE

pid	process
1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
308	Program FilesHH5V34.exe
1656	IEXPLORE.exe
1656	IEXPLORE.exe
896	IEXPLORE.EXE
896	IEXPLORE.EXE
1388	IEXPLORE.exe
1388	IEXPLORE.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
896	IEXPLORE.EXE
896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exeProgram FilesHH5V34.exeIEXPLORE.exeIEXPLORE.exe

description	pid	process	target process
PID 1744 wrote to memory of 308	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	Program FilesHH5V34.exe
PID 1744 wrote to memory of 308	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	Program FilesHH5V34.exe
PID 1744 wrote to memory of 308	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	Program FilesHH5V34.exe
PID 1744 wrote to memory of 308	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	Program FilesHH5V34.exe
PID 308 wrote to memory of 1656	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1656	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1656	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1656	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 1656 wrote to memory of 896	1656	IEXPLORE.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 896	1656	IEXPLORE.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 896	1656	IEXPLORE.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 896	1656	IEXPLORE.exe	IEXPLORE.EXE
PID 308 wrote to memory of 1388	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1388	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1388	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 308 wrote to memory of 1388	308	Program FilesHH5V34.exe	IEXPLORE.exe
PID 1744 wrote to memory of 1944	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	WScript.Exe
PID 1744 wrote to memory of 1944	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	WScript.Exe
PID 1744 wrote to memory of 1944	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	WScript.Exe
PID 1744 wrote to memory of 1944	1744	f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe	WScript.Exe
PID 1388 wrote to memory of 2024	1388	IEXPLORE.exe	IEXPLORE.EXE
PID 1388 wrote to memory of 2024	1388	IEXPLORE.exe	IEXPLORE.EXE
PID 1388 wrote to memory of 2024	1388	IEXPLORE.exe	IEXPLORE.EXE
PID 1388 wrote to memory of 2024	1388	IEXPLORE.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe
"C:\Users\Admin\AppData\Local\Temp\f0bcb9de25708f3ff7e5b380243d60d78cf6554178e2412383d80b0725a7e04f.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

\??\c:\Program FilesHH5V34.exe
"c:\Program FilesHH5V34.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308

C:\Program Files\Internet Explorer\IEXPLORE.exe
"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:896

C:\Program Files\Internet Explorer\IEXPLORE.exe
"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forxuyan_0977.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\SysWOW64\WScript.Exe
WScript.Exe jies.bak.vbs
2⤵
- Deletes itself
PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program FilesHH5V34.exe

Filesize
36KB

MD5
24b18a0bedbb1183d5fff889a245b75d

SHA1
2fbd780f06d7f509284113bea5465601764cd14e

SHA256
c853c35f67aa1ceef3ccccc32479c165a4530dc64e48ed23fcfd676bb01db090

SHA512
8d44bcb7392c46410023cfb2691b4b2cba340fdf9561a02b09f55913743568ff463799e218352adaefe4989f86e457e1f9fc3887134cf7b668d6cd2e5b8a4d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E680311-6B23-11ED-BBEF-F2255ECFD43B}.dat

Filesize
5KB

MD5
780046f1adb4f342530f72f75400f4c9

SHA1
428a167d910efdf70eb0759375bc228c7885d322

SHA256
88eb5836ba220081c0c8c51cf3df3b4fadbf14e820015d605fe05d0218171090

SHA512
1e4bfa43d6d531be480b869e7f18b7b286090b3449dde8ea5bff9bc51d115193d39d10fa1b00f5b6a828cff321f9e2462cde40044ad497311960dd32cf09229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jies.bak.vbs

Filesize
486B

MD5
92cb80c5994e0a192e2abd64a4b65122

SHA1
011cc840d3785bae845facb5c36eae8763106533

SHA256
db3564396bfdf5a635c37b374da65eb6ce64e0935ea7478bf8522e8a5b05330a

SHA512
3bc02ad4aa06aaae5d3f63e5f25af5bc1554d8b9031435a5686f3ecf56c09e7c17439c4cfe1888800b83bc2e5c602e199c6c5e3239a1c39e7ad26403680d631d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z5N50B90.txt

Filesize
603B

MD5
ec11886e713ca02279a72bc7d19c663c

SHA1
d45f4c75c0b95799da979ebffcf2971daf183fa8

SHA256
7c5e309d169ebc07adbc7edfa95282448e328308d6820202a809ead9a5c5540f

SHA512
9992775da9615bc956922b909c61fa8c547873cb096d6a07b99dd5d31aeacbffc2b0f25577f0e9a3b27ed975b0b65db078cc2fba5fb8564c703423823649ebbc

Download Submit
memory/308-57-0x0000000000000000-mapping.dmp

Download
memory/1744-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1944-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads