69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938

General

Target

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Size

49KB
MD5

043c1baf55a1eeba7200cd748c304c00
SHA1

ee7f5a4c3b3313ca240fc0bd7ba1649c3f1256f0
SHA256

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938
SHA512

d0489130cdd890bf9d7ef8ea80a840c26b03af5f5456c49192167a2da7535e3c957c328b2db7c8513b81acb2f9529c076bd52d60d0d19aa8714c7118c8675dfc
SSDEEP

768:p3iRBV996KPBJ8DGBindkfcO8ir/nhP5HdSFiF8T2OzrOPhcVc:st5JlsdkfcO8ir/nlnOPO6c

Score

10^/10

evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

Drops file in Program Files directory 1 IoCs

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description ioc process

File created C:\Program Files (x86)\Common Files\dao.ico 69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\dao.ico	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Hao123ÍøÖ·Ö®¼Ò"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Hao123ÍøÖ·Ö®¼Ò"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.114wu.com/?10"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.114wu.com/?10"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

Modifies registry class 53 IoCs

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\dao.ico"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\É¾³ý(&D)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\Attributes = "0"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.114wu.com/?10"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideOnDesktopPerUser	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\É¾³ý(&D)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20221123"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ = "CFÍâ¹ÒÏÂÔØ"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "91222"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\WantsParseDisplayName	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.cf234.com/?shenlongzm"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideFolderVerbs	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

description	pid	process	target process
PID 4880 wrote to memory of 4892	4880	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
PID 4880 wrote to memory of 4892	4880	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
PID 4880 wrote to memory of 4892	4880	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe	69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe

C:\Users\Admin\AppData\Local\Temp\69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
"C:\Users\Admin\AppData\Local\Temp\69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
C:\Users\Admin\AppData\Local\Temp\69d36e2db7fcae14d1712286ffe8f234b6a8844671834b90a7e6dbc67b59e938.exe
2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4880-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4880-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4892-132-0x0000000000000000-mapping.dmp

Download
memory/4892-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads