Overview
overview
7Static
static
11054255.exe
windows7-x64
71054255.exe
windows10-2004-x64
7不会安�...�.html
windows7-x64
1不会安�...�.html
windows10-2004-x64
1主题之家.html
windows7-x64
1主题之家.html
windows10-2004-x64
1安装没�...�.html
windows7-x64
1安装没�...�.html
windows10-2004-x64
1懒人上�...�.html
windows7-x64
1懒人上�...�.html
windows10-2004-x64
1桌面壁�...�.html
windows7-x64
1桌面壁�...�.html
windows10-2004-x64
1桌面美�...�.html
windows7-x64
1桌面美�...�.html
windows10-2004-x64
1Analysis
-
max time kernel
108s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
1054255.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1054255.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
不会安装请点这里.html
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
不会安装请点这里.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
主题之家.html
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
主题之家.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
安装没效果请点这里.html
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
安装没效果请点这里.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
懒人上网请点这里.html
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
懒人上网请点这里.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
桌面壁纸-高清.html
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
桌面壁纸-高清.html
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
桌面美化软件.html
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
桌面美化软件.html
Resource
win10v2004-20220812-en
General
-
Target
不会安装请点这里.html
-
Size
276B
-
MD5
3c81df64bfeaaf8d16d10a641183b45a
-
SHA1
bb3f4295e678d62539ba2a63154b43473a34a764
-
SHA256
423ddcd0f1f21d86616c9513d16315d1f98f5e561921d18c6e18f4506f96aa2f
-
SHA512
4659ac07118d30f2f7e4a3aa1fdcbbd03ad8e2a4db9006c719cd6906e3bf1a797a6b98e3c2b02c9d2ad618424b14ae830b203aba4027ae1855e42f4001dd20b6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000b5023727450f795da822f67612f15fcb2195e55c4f6f1edb9a22d6f6993460b3000000000e800000000200002000000013742d10f236c2bbdec37266b5e84fcb162ade3c6536be02e14f634566f8b3b590000000c1c99c2a79a5f63017057e1222542d009c88e9efcc49728e3cb9b8860b75dfcedb0e925b8b23b04aa557ba98cbadb0bf24d9d6ce49dc3484173cd8508a8351e67d045838ddddfa3f21366f918697da3101331ca3f28259e59cf15681e1d2036f8df2f5d718368ecebca0b5ec5efe6d47b28462d98a2937da4bb7a5a5fe64b5c085506bf9392495a3509a0543504f5f5c40000000930f77f3218ef7ca663a03aaf4178f93396f36aaa510c9cde9aa8f542b85c43e13ca4a8c0507fe5713da8cc7bd8baa228c1155a9c0bcaedbee04cf341c91aeec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07a7cb089ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376006924" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D84F5D31-6B7C-11ED-BB11-F263091D6DCE} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000e714ca629a6e926bd1bb70d313dba4c5f4ad3526f7168a543a986d5c54623f74000000000e8000000002000020000000f3c13d47751826c9c87b166a2222f4f1465601e2265020ace9e4603a3cd0f0f320000000325aa4b82beff03a71d7ab21a4d86a6fa9c7a12dd8e05ddfd3d3463e4c501eaa400000003c2b8e4b592e32ca5375f5ee3a2b19170101e5a76fb55f82ea0e483301d908e831a6a94139bee826099709ea4262b4ada733e120e92ed36a66caecdf549d6275 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1060 iexplore.exe 1060 iexplore.exe 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1060 wrote to memory of 520 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 520 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 520 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 520 1060 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\不会安装请点这里.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
596B
MD5695eed3e5909bf9276a481eb892ed120
SHA1e4ad52e3616d7a5916f46eb9942678c950d5f63b
SHA2565b9f003a7b315c44af5d7b36aa425499f1209fc2dc48f8a3f64c9c7951ca8fa2
SHA512cc1fc587b6b9c4d96b9da95e5ba43465a236243825e462a6af260ed3b969dd24acba52642caece7b9ad1b8eeaa4d4e3710215bb1261c0e04b9781e29610d7f41