Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe
-
Size
212KB
-
MD5
5248fd2249fee4a26ea4dfb1543424d3
-
SHA1
df7755f5766a598dc158f78686fa3ca0b8070cbc
-
SHA256
5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a
-
SHA512
1acf4a6cc9426095493a8a143ec96cd8f216ed4458044d57c0faa2b880a1dd4cea3b6ef73b94e6c5b7aac45a5cad304201939d567e16c9b0b620910c94e3b7c8
-
SSDEEP
6144:dcyyU/A5rZRLEhFTnRa26s+Wdz8V7Wdfwn1nbmuSDmw:dHp/urb4A1WdBfj
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 752 Program Files77A2UY.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\t.ico 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe File opened for modification \??\c:\Program Files\Common Files\d.ico 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae692d575da7a24982ad1823634dfb64000000000200000000001066000000010000200000004ec82884de42da40ee509f043eca233287d281159f60eb4923b4257152546477000000000e8000000002000020000000a1a78762ec5325de9de9b508b3e5106bcb925cfdba4d378169b982a1f2de8b2d20000000784d75f8554d664d32efcc4bdeb851034d49078badfdab23dcae80af7ead72ab40000000f0956e02791cdfdd9ee987d45e029605cb856adf7aba36c642e11feda45a606c4dfd9b6a7eb24009537c56cd3db8832d2a7c1e6d1d1073c6d595a96b13a018c0 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09c6430a0ffd801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C17B78F-6B93-11ED-AECB-D2A4FF929712} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "555811127" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998432" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "617999151" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20011531a0ffd801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376016571" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "555811127" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998432" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998432" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae692d575da7a24982ad1823634dfb6400000000020000000000106600000001000020000000692c291d3c84c9cc1c59909a9f8086d1a26655aa96154b5f0527687130a78f3c000000000e8000000002000020000000220c54da55ecad13f02cb35516c30c840811beb829b5808650d36b185b149311200000002eb72db6b4631216ab2eb461d020e5c423c34c813ccf230547ec415c8ac9696540000000a09a49a095bd4e4fd9e0a680b7b7ba40dfe9350ba9bde6075052e1e256299dccba19987ee07b0ebba0426693569bf987c92371f44eb2ac237f98226327ac1ed5 IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4932 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 752 Program Files77A2UY.exe 4932 IEXPLORE.exe 4932 IEXPLORE.exe 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 940 wrote to memory of 752 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 80 PID 940 wrote to memory of 752 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 80 PID 940 wrote to memory of 752 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 80 PID 752 wrote to memory of 4932 752 Program Files77A2UY.exe 82 PID 752 wrote to memory of 4932 752 Program Files77A2UY.exe 82 PID 4932 wrote to memory of 1108 4932 IEXPLORE.exe 83 PID 4932 wrote to memory of 1108 4932 IEXPLORE.exe 83 PID 4932 wrote to memory of 1108 4932 IEXPLORE.exe 83 PID 752 wrote to memory of 4804 752 Program Files77A2UY.exe 84 PID 752 wrote to memory of 4804 752 Program Files77A2UY.exe 84 PID 940 wrote to memory of 1736 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 85 PID 940 wrote to memory of 1736 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 85 PID 940 wrote to memory of 1736 940 5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe"C:\Users\Admin\AppData\Local\Temp\5e205172c0509adcead597dd7a42cacbb9e9930efa4ab38d0fcef22cebb1c08a.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\Program Files77A2UY.exe"c:\Program Files77A2UY.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4932 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:4804
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:1736
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5ad5a0b3432a042d599255b96336bdb90
SHA127d6882e9cc9d197fa4ea2b6a4066f0bdc5a4721
SHA256d434eeb46eacb5662547f630935f134b88147cd4107a89c1f61c1a7a1d5f7a1b
SHA5122cb0f0a643a0b86dc28986b459aca80f37a39fdc1db6578b0672ab569dbffcced71b943e7b53104051ec858de89612a7ff3ec4dada0a9c47672c8dbef17c5898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5e32d02ce684c01ef3af05fae9066160e
SHA129c7a6e8ed553ac2765634265d1db041d6d422ec
SHA256b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71
SHA512e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD583faaa144912cbf43b1072b4f061c306
SHA1e7889573103eed2bb40cb3de95092cec30ac41fa
SHA256da38a90499195989f7154266f70dcb4caafbcfd1f4b203fc3cea26d432774b0b
SHA512a8e05f4ba0424629be1012e70b48c3ee516f51737414cfa480537164e8c37cc3a2e470d41c9d7b3523cb0ea53e5578766a0b1aa6de91f5e73a5298fa660835fa
-
Filesize
486B
MD5dc6748413136c415608331bd20942499
SHA1ba0c115b980e81819e950fd698802a09a5fa589d
SHA2566ff48303c2d9363ac36aa749b157da9da512a4d7db8be8c9ac778cb42bdaf639
SHA512b2ed984d523cd87902f012e377fb343d26c944e73953e8f1c4f08f5517e57d76dc2ec27513b054f9b27d4dd25c83d0806ccfa3a6f03ac3886f879dd15e1e266a
-
Filesize
36KB
MD5ad5a0b3432a042d599255b96336bdb90
SHA127d6882e9cc9d197fa4ea2b6a4066f0bdc5a4721
SHA256d434eeb46eacb5662547f630935f134b88147cd4107a89c1f61c1a7a1d5f7a1b
SHA5122cb0f0a643a0b86dc28986b459aca80f37a39fdc1db6578b0672ab569dbffcced71b943e7b53104051ec858de89612a7ff3ec4dada0a9c47672c8dbef17c5898