Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:32
Behavioral task
behavioral1
Sample
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe
Resource
win10v2004-20220812-en
General
-
Target
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe
-
Size
1.5MB
-
MD5
3ac7778874aad335ff9fbf7f8742e37b
-
SHA1
9cc65285945579e1f62c6c1e10d13f4e7d8aa404
-
SHA256
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e
-
SHA512
1810a3948e954881ac32a4cf888a0c0d72a908c4a451375f2e6381187827c50694fbc0bd785376f45554b52f1b9fb69d907511934d580eecf4d42bb4e4e03f47
-
SSDEEP
24576:AcOJuEozSAtY6t6Gz/s3a4gXSPIi6m1KMqabhwj4/f7Nkv4:AbuE8SMlTs3aBYKyb6j4XCv
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/552-55-0x0000000000400000-0x00000000007DF000-memory.dmp vmprotect behavioral1/memory/552-56-0x0000000000400000-0x00000000007DF000-memory.dmp vmprotect behavioral1/memory/552-58-0x0000000000400000-0x00000000007DF000-memory.dmp vmprotect behavioral1/memory/552-59-0x0000000000400000-0x00000000007DF000-memory.dmp vmprotect behavioral1/memory/552-61-0x0000000000400000-0x00000000007DF000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exepid process 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy7.tv IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "252" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cqyongshi.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cqyongshi.com\Total = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy7.tv\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43469BB1-6B61-11ED-8803-52E8C5FCC7C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cqyongshi.com\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy7.tv\ = "63" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e86d572fbeb76a4dbf54e693bc4763e600000000020000000000106600000001000020000000ba1eef0a938d3cabff8d9b4d2e5293970686f5d02dac91137ba80dbddd72ca7d000000000e8000000002000020000000ee5117568125d260c6b64bb1d3d6e30e1c3595fa02505c4abce72793b3de4fe420000000e47f13f95e215e3c46674dd9e7d1cf2340726d137706643f0acd8c3f665dae0c400000005101474b2aa577d595875a327582e4ba7d71403b21c5fb3dcc56d4be1d0cb808283d701f9b02f1dc01843f3b3da3b0849db18f77898cd4f651fbdb0b0ce0a6f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\mgy7.tv\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cqyongshi.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e86d572fbeb76a4dbf54e693bc4763e60000000002000000000010660000000100002000000089b377e9cc6f370d8441c057c8b883da97b4f4758e99312fe682d50b842da140000000000e80000000020000200000000bf206f54baa29463aae8626164e66d2d3523b4c7f039be855324a2ffa1d5f93900000009d6ccb4d8f78e32eda8dfbaced187d05dbade6c919413eb16b7c3342e809191419cce569d28400580e5543de30fd2c9ccccb96488f1ea1e3d60aa81cd78b224b30367b5711f850b35328f9464103814d047b6184cb67c5ce65a77e42e28f2167f94c358ca583064401e058adb44834b1e2f4d635f483a3d070f1c63a1fb434c625bc739d183483bdf50b1e27462b006a40000000d4b49819538449d91a7442049c70173744d69f6ecf4173b86e12178472e91ae58aa4a2c77e416d3f3eb4aac13374aeec64577275c5668b6359a9341aea3f0d57 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5030c42c6effd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cqyongshi.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cqyongshi.com\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375995080" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cqyongshi.com\ = "189" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\cqyongshi.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cqyongshi.com\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exepid process 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exedescription pid process Token: SeDebugPrivilege 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1756 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exeiexplore.exeIEXPLORE.EXEpid process 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe 1756 iexplore.exe 1756 iexplore.exe 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exeiexplore.exedescription pid process target process PID 552 wrote to memory of 1756 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe iexplore.exe PID 552 wrote to memory of 1756 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe iexplore.exe PID 552 wrote to memory of 1756 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe iexplore.exe PID 552 wrote to memory of 1756 552 5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe iexplore.exe PID 1756 wrote to memory of 1968 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1968 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1968 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1968 1756 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe"C:\Users\Admin\AppData\Local\Temp\5efab328135e92825552dbdd28e63d93e2538075edcdc13152ad9ca57ab3d73e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.cqyongshi.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d26ed21bd24bda3a4a7713ad7817c708
SHA1dab3972c97f128da54eddc2e15668e0224c3b1b8
SHA256705c6742933812b8ab9e562655861d61f00f77c796dddf044390db3eadc1bfef
SHA512b12d219888d223723ebd797c80417a20771f6eb980bb22763d9c0f0bc88c23a84cd1fb58861cf200bc504910106fc1d17293f86f47510684a4616ce5edfc7748
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NQL0VX6K.txtFilesize
603B
MD527fbad65e2dde24117d8b3a180b4db88
SHA187a31108e7910c596524bad34882d424d9d76dd7
SHA256b3f3a63b17e49b335a990850380d6e7d1a355cba7e2d8690f8a77c5d4cbb8b4a
SHA51256a185b5dab6e955ab3e6dfd226e5df8d4a1b25c070ec96a97c58db590cc8737e0be97411835b16164a447aa19a518803d892da0961237e4d4018320ea2b94b7
-
memory/552-54-0x0000000075131000-0x0000000075133000-memory.dmpFilesize
8KB
-
memory/552-55-0x0000000000400000-0x00000000007DF000-memory.dmpFilesize
3.9MB
-
memory/552-56-0x0000000000400000-0x00000000007DF000-memory.dmpFilesize
3.9MB
-
memory/552-58-0x0000000000400000-0x00000000007DF000-memory.dmpFilesize
3.9MB
-
memory/552-59-0x0000000000400000-0x00000000007DF000-memory.dmpFilesize
3.9MB
-
memory/552-60-0x0000000002150000-0x0000000002162000-memory.dmpFilesize
72KB
-
memory/552-61-0x0000000000400000-0x00000000007DF000-memory.dmpFilesize
3.9MB