Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 20:42
Static task
static1
Behavioral task
behavioral1
Sample
86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe
-
Size
1.2MB
-
MD5
1f597c26d7c80d9981ea823e1f39a14d
-
SHA1
9f5170a405b158411d1025be9012c0ca6d1b95a7
-
SHA256
86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692
-
SHA512
e07c01d30c55b4bed5ce87ac246967a45758999ce01f1a74c2f047334a434af87ce71050e29cd5b147e617bfdbec2008052a26f16e6cc332416a4bb621496dbe
-
SSDEEP
24576:584Fb6PHUotlxRz0rs2y62W5su0S7sBpbum:5/6PHpMA2y6L0S7sBpKm
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\31630a11e0b78d45a79d68434485c5bf.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\1a00f88711a7904e9fbfb18f5bca25ca.tmp expand.exe File opened for modification C:\progra~1\ico\meiv.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\1eec74e75ca49340b90b81fa7ceba20a.tmp expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\37767a69bdf9d045a1f83391ca77bd66.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\d9360a002cdf7a4f8ec902f826b7a891.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\0a3d5bb159ea3c4aa15e3f440b9ba625.tmp expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1012f2699dffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{822828B1-6B90-11ED-A503-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f6bdc75f385a749bf76673784c6b79f00000000020000000000106600000001000020000000c99078648714f7d7d05faefc4ce7f9dca042275f14ea3fffe93dd96770563a4c000000000e80000000020000200000005abaa928cb5f8b6d2217952907c543756dd7c4f7694d00979c46c72be9eb599020000000cd2525f867a1010ed391f991d8da3b47de51c4d17e89fbd8ba49debe90c01a5a40000000ad8fd122555721eadbb4ae4fe43cccba5ddf070e0218dcb16bb2690a4dd5a781960f1a9c305025527b1dcfd1014b89502c2b3b593578c4e93a87d6bd25ab595c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f6bdc75f385a749bf76673784c6b79f00000000020000000000106600000001000020000000fac26de1bb3c69dab43c019115968a5629c9745ff0d808ef6a37121236bcdad5000000000e800000000200002000000033a0e5e88c20ef5e6c16bf809f6c08f64a7dcc69f2ef9aad197443042fd264aa900000008dbbc17b7fa6e1f2e74cf2e42a08b7ba02779107640aeefab6f03f5bff2c73faee65deaf350534a44935de45d68cc401270b90006aeba2fc926cb931fc2df906a1fe0d561991921463ca79533f5b3a040f4ef0d17accc49a449ce2d307508a0ae89d21895a0c9ccf476bc25faa5a2c8a97780ebf353867943fd52e21f455853260bb00b3958b50cc36cd0c6f9198f107400000006337692b05a67f32a165beada44484804045535425457a44dded8c78e46014b1a7a8352a2fd67aa76e2ea33e13ba1024f3776a0e0ea62fe43a20c9b97dec2c85 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376015375" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 1760 iexplore.exe 1760 iexplore.exe 964 IEXPLORE.EXE 964 IEXPLORE.EXE 964 IEXPLORE.EXE 964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1168 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 28 PID 1516 wrote to memory of 1168 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 28 PID 1516 wrote to memory of 1168 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 28 PID 1516 wrote to memory of 1168 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 28 PID 1168 wrote to memory of 1532 1168 cmd.exe 30 PID 1168 wrote to memory of 1532 1168 cmd.exe 30 PID 1168 wrote to memory of 1532 1168 cmd.exe 30 PID 1168 wrote to memory of 1532 1168 cmd.exe 30 PID 1516 wrote to memory of 1356 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 27 PID 1516 wrote to memory of 1356 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 27 PID 1516 wrote to memory of 1356 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 27 PID 1516 wrote to memory of 1356 1516 86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe 27 PID 1364 wrote to memory of 1760 1364 explorer.exe 33 PID 1364 wrote to memory of 1760 1364 explorer.exe 33 PID 1364 wrote to memory of 1760 1364 explorer.exe 33 PID 1760 wrote to memory of 964 1760 iexplore.exe 34 PID 1760 wrote to memory of 964 1760 iexplore.exe 34 PID 1760 wrote to memory of 964 1760 iexplore.exe 34 PID 1760 wrote to memory of 964 1760 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe"C:\Users\Admin\AppData\Local\Temp\86c3a5d1bd1ded33b6feea53e5312021a2215d86af3af8a95513632d68460692.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:1356
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\yDbhp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1532
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:964
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
606B
MD555ba63217b1272c7c78c9239c7395dfa
SHA12d05fc9dafe66a185e2747c663e7e524591b1d10
SHA2567f5aac20036c0f4c73e83fe9af95dfe4d3d7afeea6215124e30c90ecf7ef76b5
SHA5125e9ce2d53ae43959939ef2886be1a37e691d86286495b00f0bd1a2257f5cc27693d26088418923100c7684c4065c62f84a0dede98c0fd4c33298e568855a8824
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f