ecc3a87bd099d68fc0d32a0f7fe68275791b29c881d4864e4a7c19e6e2d0dc84

General

Target

【咚咚】Q游记1.0版本辅注/【咚咚】Q游记1.0版本辅注.exe
Size

2.2MB
MD5

511128c6fe206c3b6bf1fbdbddaab6e8
SHA1

8983c9d0fb668346af03ff8dd2dc067baf540100
SHA256

8bd164cbb2f483747ec279577d7190f509858ec6b0d590d91789a1dec3269f23
SHA512

3aa1b2c332a7e645c7e1ccda24ed2856fefbed0ba1629bebe1ff28b375c7d3908ff2af65e38c85db11adf909829ac3e7cab5bdc02cefabc86857a584aff6e61e
SSDEEP

49152:cj5ime12WXZluhYH2njFi3bs/XcYODKK5yynEd+t91pvI8S+JxF:c5eZVH2BOmXcYOBwynXX

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/996-55-0x0000000000400000-0x00000000008B5000-memory.dmp	vmprotect
behavioral1/memory/996-57-0x0000000000400000-0x00000000008B5000-memory.dmp	vmprotect
behavioral1/memory/996-58-0x0000000000400000-0x00000000008B5000-memory.dmp	vmprotect
behavioral1/memory/996-60-0x0000000000400000-0x00000000008B5000-memory.dmp	vmprotect
behavioral1/memory/996-61-0x0000000000400000-0x00000000008B5000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07F68F91-6C09-11ED-A6C3-FE72C9E2D9C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c07e83b71aad844cbcc2f0242906f80400000000020000000000106600000001000020000000a6dcbdf5845e4b6999dd8afd42b2113d1b4d308083b4ea428dee5e4389936bc0000000000e800000000200002000000018376d02f57284e023aacf5fed1d68de7f2d16ea1220c00163c37939e97d197690000000203694333a34974504faba59e57e0e4d646a4b292a1fff8ec09366d2d749514f7928625bc2a582304b3b227a7e7e2bd35e4c2b147a41c3b2e935e372172eac363cc409b2f43cc14a762d602acb8bdcbe2810d444c51d92e0799a0f1d3d571cb1dc592629fb4dc9467b5656fe22280d97c879dc2af3a8db098ca3d6c839537b0e0a6d85d636bd63d8513029bee4ea5cbd40000000c032ab0cd023c081f61f40ef626bf7edeaa57153d3ed488f26176fed46d8e4b03a6842aba63064ab73aecdab230d9f1fa3f6b675248869f16dc85a29c5b4c566	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c07e83b71aad844cbcc2f0242906f80400000000020000000000106600000001000020000000b7e91ae50502e336e7b1e30e176211952ec48807071537d5d32ef0d06d8660ad000000000e8000000002000020000000260b0e2289b211e3c4ea7c10c6a520983e32aa4a95239e5afedd0f32dc65b1d220000000801a687033653649c843208a116db5aa36155243f4f20138b1ae7ef8ca53ef8c400000007d28185ccb384bc26caecdbc9258b7a2cce933727a67e688b31b62f070e8b5f233858725440e32b01366b72531afcc2b66f11e4562d0d755b3c02925d86b4977	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376067132"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10071ce61500d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

【咚咚】Q游记1.0版本辅注.exe

pid process

996 【咚咚】Q游记1.0版本辅注.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1036 iexplore.exe

pid	process
1036	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

【咚咚】Q游记1.0版本辅注.exeiexplore.exeIEXPLORE.EXE

pid	process
996	【咚咚】Q游记1.0版本辅注.exe
996	【咚咚】Q游记1.0版本辅注.exe
1036	iexplore.exe
1036	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

【咚咚】Q游记1.0版本辅注.exeiexplore.exe

description	pid	process	target process
PID 996 wrote to memory of 1036	996	【咚咚】Q游记1.0版本辅注.exe	iexplore.exe
PID 996 wrote to memory of 1036	996	【咚咚】Q游记1.0版本辅注.exe	iexplore.exe
PID 996 wrote to memory of 1036	996	【咚咚】Q游记1.0版本辅注.exe	iexplore.exe
PID 996 wrote to memory of 1036	996	【咚咚】Q游记1.0版本辅注.exe	iexplore.exe
PID 1036 wrote to memory of 1928	1036	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 1928	1036	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 1928	1036	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 1928	1036	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\【咚咚】Q游记1.0版本辅注\【咚咚】Q游记1.0版本辅注.exe
"C:\Users\Admin\AppData\Local\Temp\【咚咚】Q游记1.0版本辅注\【咚咚】Q游记1.0版本辅注.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://52dong.wo.cc/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
38303a9357c14aaf55477c5419df89b0

SHA1
bda351600d527ce0e16e7f7ca84135a0b50511fe

SHA256
35613ab95ee175a0385622d8467cad39c4d9bf845d19634dd2c39cc591bd570f

SHA512
d7b34b3936105d98b8eb4762a8e0a3667f7582072708ac3f70a83aa2ee9c4504f4e65798bbe053946354c092c5a2efcd9e40d27776fed8fd3c0a916815633402

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y6RQ0O90.txt

Filesize
603B

MD5
12833425bdaa6d41c599acea56844625

SHA1
e4f265190e45e6952fc4523967044bf940fdb51e

SHA256
5c488a29384d85910ed2dc6a3fb3808ab6c6fc4b6868128b66a445e86b702394

SHA512
f76ec903d3dbd5787b93f64e29463c6bd3517e2dcdac79bcf910d6a208e40ab6d584b01c5d35f6958723367762be80bbfd5d776085876b6b04e6a43c413faaf8

Download Submit
memory/996-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/996-55-0x0000000000400000-0x00000000008B5000-memory.dmp

Filesize
4.7MB

Download
memory/996-57-0x0000000000400000-0x00000000008B5000-memory.dmp

Filesize
4.7MB

Download
memory/996-58-0x0000000000400000-0x00000000008B5000-memory.dmp

Filesize
4.7MB

Download
memory/996-60-0x0000000000400000-0x00000000008B5000-memory.dmp

Filesize
4.7MB

Download
memory/996-61-0x0000000000400000-0x00000000008B5000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads