Overview
overview
7Static
static
11054255.exe
windows7-x64
71054255.exe
windows10-2004-x64
7不会安�...�.html
windows7-x64
1不会安�...�.html
windows10-2004-x64
1主题之家.html
windows7-x64
1主题之家.html
windows10-2004-x64
1安装没�...�.html
windows7-x64
1安装没�...�.html
windows10-2004-x64
1懒人上�...�.html
windows7-x64
1懒人上�...�.html
windows10-2004-x64
1桌面壁�...�.html
windows7-x64
1桌面壁�...�.html
windows10-2004-x64
1桌面美�...�.html
windows7-x64
1桌面美�...�.html
windows10-2004-x64
1Analysis
-
max time kernel
97s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
1054255.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1054255.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
不会安装请点这里.html
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
不会安装请点这里.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
主题之家.html
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
主题之家.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
安装没效果请点这里.html
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
安装没效果请点这里.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
懒人上网请点这里.html
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
懒人上网请点这里.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
桌面壁纸-高清.html
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
桌面壁纸-高清.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
桌面美化软件.html
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
桌面美化软件.html
Resource
win10v2004-20220812-en
General
-
Target
桌面美化软件.html
-
Size
269B
-
MD5
80fcfacdca2dd7d7bdb67850d4f1e06f
-
SHA1
3e499f4d57ad2e92e4db323d23cba035399dec1d
-
SHA256
cc4282aa26ffb2812f841f593dca8fc41cd395b56773785dad5a934495f7a849
-
SHA512
f4f4c444d023a1b70659eb8b56eff963f08a16437da676c332b915b893c2ca51e554d2679accdeb27b645b2d941a4978e8a546341945ea897c7b363a436ba167
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000004efd2fe36e02e1bf946931247bcf415332d92513983bd03bf7e44f2c57ee19b6000000000e8000000002000020000000614e771b6cb63e516d5a3e3ca7a6cd4c18cbfc409dc51389634c23262c0ed2cf20000000fba25a8b566b619a361c0cfe4660a5cbef46a149c510e367eea5e6d97d4593dd400000001ad3f375e2f0f512060f635deba5a93f6addfec03747b797df1f89c4fda9b80e6786b57b3e895a0a0b3dc20757d725d7940e452c00b82c59d45b3e7ae5b28ce2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e095ac3b81ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376003290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000e06c94fcbe9f544ab5be11c77cda4df57c0d50723c3171c8b0ab03553960d223000000000e80000000020000200000002bc58efd6d4040712ff4793d3131b8ef10e58421ac96f6271c76b4fde137452890000000fa64fc8a6752870f996231b9ecbbae9ac3ba45259d76f45622e1ee425b4466f10078af3b652db4d4646bc4c254da4ab0873a82f414782dee32040628118246b61c0472e95f1f209c874b7958156af702c4c0a39a97d229fc318730f231dd06e86032c6f089a4a03ffc045e0860654fda7cab03e047d3d3cd3964b0f30d7d664dd229ab0c69741401d4c5fc077afcdc0040000000677b95b18e8401a6996d7d42740d93d875faa334056bc8d8dd323c7348baa1b027c14859e846a8dd610f035f83ea8e5d4cdbac18293e303d97ca8d20d127d95a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{639E98F1-6B74-11ED-9ECC-C253C434FFA8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1768 iexplore.exe 1768 iexplore.exe 1052 IEXPLORE.EXE 1052 IEXPLORE.EXE 1052 IEXPLORE.EXE 1052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1768 wrote to memory of 1052 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1052 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1052 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1052 1768 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\桌面美化软件.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD52a7093cfd85850fbb92451fba66a509f
SHA1e02e27800f373c637bac18ba76e81c9872c7eaf1
SHA256683b7d266771cac3f7dfc6c49148d53633ce94ccb9e95996bc8da844103a46e1
SHA512f38f0f12885da638034f6fa5569f8e0a06dbf679388e8a7b5f78486771868000af70aeb9df737114dfac2d9758aad9856655df70499d5bda5be392beb58f27aa