Overview
overview
7Static
static
ipacc/)!�...��.url
windows7-x64
1ipacc/)!�...��.url
windows10-2004-x64
1ipacc/HotV...r.html
windows7-x64
1ipacc/HotV...r.html
windows10-2004-x64
1ipacc/HotV...t.html
windows7-x64
1ipacc/HotV...t.html
windows10-2004-x64
1ipacc/HtmlPeek.dll
windows7-x64
5ipacc/HtmlPeek.dll
windows10-2004-x64
5ipacc/iRes.dll
windows7-x64
1ipacc/iRes.dll
windows10-2004-x64
ipacc/index.dll
windows7-x64
3ipacc/index.dll
windows10-2004-x64
3ipacc/ipacc.exe
windows7-x64
7ipacc/ipacc.exe
windows10-2004-x64
7ipacc/ipacc_v2.dll
windows7-x64
1ipacc/ipacc_v2.dll
windows10-2004-x64
1ipacc/ipaccu.exe
windows7-x64
1ipacc/ipaccu.exe
windows10-2004-x64
1ipacc/ipla...er.swf
windows7-x64
3ipacc/ipla...er.swf
windows10-2004-x64
3ipacc/ipla...yer.js
windows7-x64
1ipacc/ipla...yer.js
windows10-2004-x64
1ipacc/ipla...ect.js
windows7-x64
1ipacc/ipla...ect.js
windows10-2004-x64
1ipacc/istat.dll
windows7-x64
3ipacc/istat.dll
windows10-2004-x64
3ipacc/jifeng.dll
windows7-x64
3ipacc/jifeng.dll
windows10-2004-x64
3ipacc/说明.url
windows7-x64
1ipacc/说明.url
windows10-2004-x64
1Analysis
-
max time kernel
40s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
ipacc/)!访问我们的网站!.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ipacc/)!访问我们的网站!.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ipacc/HotVideo/pageerror.html
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ipacc/HotVideo/pageerror.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
ipacc/HotVideo/pagewait.html
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
ipacc/HotVideo/pagewait.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
ipacc/HtmlPeek.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
ipacc/HtmlPeek.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
ipacc/iRes.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
ipacc/iRes.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
ipacc/index.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
ipacc/index.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
ipacc/ipacc.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
ipacc/ipacc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
ipacc/ipacc_v2.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
ipacc/ipacc_v2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ipacc/ipaccu.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
ipacc/ipaccu.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
ipacc/iplayer/iPlayer.swf
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
ipacc/iplayer/iPlayer.swf
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
ipacc/iplayer/iplayer.js
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
ipacc/iplayer/iplayer.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
ipacc/iplayer/swfobject.js
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
ipacc/iplayer/swfobject.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
ipacc/istat.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
ipacc/istat.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
ipacc/jifeng.dll
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
ipacc/jifeng.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
ipacc/说明.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
ipacc/说明.url
Resource
win10v2004-20221111-en
General
-
Target
ipacc/jifeng.dll
-
Size
92KB
-
MD5
aab6b655c762d23f0cb1f637a89618b7
-
SHA1
8c04e00597c1d79371d198265b57c3de5216fa3d
-
SHA256
7e46bb82ca755e4de75cf7c5809cb08152cf08199917a8821785f7ec6716ca35
-
SHA512
7c663042bea8d55bc0b211dcf88d7df32691818d66ab181f81ea8de42b04c285354b4e837647713484239082bb3ead692d676ec30f4c058860b7faca54744b62
-
SSDEEP
1536:9pyxTQJgERdH+BFUEpf1lzHRfIevaMalJt+JJP6:GTQJgERCieaMalJt+zS
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1496 868 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 1316 wrote to memory of 868 1316 rundll32.exe rundll32.exe PID 868 wrote to memory of 1496 868 rundll32.exe WerFault.exe PID 868 wrote to memory of 1496 868 rundll32.exe WerFault.exe PID 868 wrote to memory of 1496 868 rundll32.exe WerFault.exe PID 868 wrote to memory of 1496 868 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\jifeng.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\jifeng.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 2283⤵
- Program crash
PID:1496