Overview
overview
7Static
static
ipacc/)!�...��.url
windows7-x64
1ipacc/)!�...��.url
windows10-2004-x64
1ipacc/HotV...r.html
windows7-x64
1ipacc/HotV...r.html
windows10-2004-x64
1ipacc/HotV...t.html
windows7-x64
1ipacc/HotV...t.html
windows10-2004-x64
1ipacc/HtmlPeek.dll
windows7-x64
5ipacc/HtmlPeek.dll
windows10-2004-x64
5ipacc/iRes.dll
windows7-x64
1ipacc/iRes.dll
windows10-2004-x64
ipacc/index.dll
windows7-x64
3ipacc/index.dll
windows10-2004-x64
3ipacc/ipacc.exe
windows7-x64
7ipacc/ipacc.exe
windows10-2004-x64
7ipacc/ipacc_v2.dll
windows7-x64
1ipacc/ipacc_v2.dll
windows10-2004-x64
1ipacc/ipaccu.exe
windows7-x64
1ipacc/ipaccu.exe
windows10-2004-x64
1ipacc/ipla...er.swf
windows7-x64
3ipacc/ipla...er.swf
windows10-2004-x64
3ipacc/ipla...yer.js
windows7-x64
1ipacc/ipla...yer.js
windows10-2004-x64
1ipacc/ipla...ect.js
windows7-x64
1ipacc/ipla...ect.js
windows10-2004-x64
1ipacc/istat.dll
windows7-x64
3ipacc/istat.dll
windows10-2004-x64
3ipacc/jifeng.dll
windows7-x64
3ipacc/jifeng.dll
windows10-2004-x64
3ipacc/说明.url
windows7-x64
1ipacc/说明.url
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
ipacc/)!访问我们的网站!.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ipacc/)!访问我们的网站!.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ipacc/HotVideo/pageerror.html
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ipacc/HotVideo/pageerror.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
ipacc/HotVideo/pagewait.html
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
ipacc/HotVideo/pagewait.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
ipacc/HtmlPeek.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
ipacc/HtmlPeek.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
ipacc/iRes.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
ipacc/iRes.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
ipacc/index.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
ipacc/index.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
ipacc/ipacc.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
ipacc/ipacc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
ipacc/ipacc_v2.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
ipacc/ipacc_v2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ipacc/ipaccu.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
ipacc/ipaccu.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
ipacc/iplayer/iPlayer.swf
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
ipacc/iplayer/iPlayer.swf
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
ipacc/iplayer/iplayer.js
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
ipacc/iplayer/iplayer.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
ipacc/iplayer/swfobject.js
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
ipacc/iplayer/swfobject.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
ipacc/istat.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
ipacc/istat.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
ipacc/jifeng.dll
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
ipacc/jifeng.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
ipacc/说明.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
ipacc/说明.url
Resource
win10v2004-20221111-en
General
-
Target
ipacc/HotVideo/pageerror.html
-
Size
1KB
-
MD5
7db35201d8189e092997fae0163b4cc8
-
SHA1
3f14342a77e7d8be68c89cada5db7a1570e234ee
-
SHA256
5e76e12a0628658e0841c9e00e14c2a579a88ff7a5938e7a9a3ca99611454d42
-
SHA512
609ebec14cc8e3d1671e39924d68826a93f1f88a42c1d3d1bcc270f35d8e95b139ab99d44570ea64517d256351c137d6f9eede08a16b2ed1167dc87f0f8e8fe7
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998504" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000055f19ce899a2a2c796a561849bfb6cc4da92ffc364213a1229666c3eb7538819000000000e8000000002000020000000d71dbbed296771846ae9ef91c5594dfc41d5920547f26aaf9469b5dcdb24be3320000000099cea2abe8a0955e04253d101d0c0e0f61c11e46c66c8216c6067125d13f42c40000000d0846015fd979e24fff61c0c011cc50486dacc2f3f4b6bce3b126200a788a85c2a3e22b2585b77b7f00865402c9256b417ac4b22d6101a4a0c82fdd8b146af62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998504" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2894389229" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998504" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D5FBB97B-6BDB-11ED-A0EE-6E8F4548B5DC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2894389229" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000007daa91b30d55733d9b162664d7f31b778242ca597bc5620b8d6d11d660b71754000000000e80000000020000200000006565cda07f9c5c1cd3996d05acf48902f98e3fab88ac480e9d18edc95ed37cbf2000000015cb165117f471cd3ef4d4e7fa1cb8701b1f945a727fe346b76e2bdb52609f3e40000000dbaca6418c2477c321e9d3a8220637dc3c21467912bb9e7f5160e6741629e4c1eb95afd72b14471387c5c117814ae3e026ac5389011c4c88f757d983de19fbb4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376047724" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205c89afe8ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2915327679" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506771afe8ffd801 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4104 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4104 iexplore.exe 4104 iexplore.exe 4828 IEXPLORE.EXE 4828 IEXPLORE.EXE 4828 IEXPLORE.EXE 4828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4104 wrote to memory of 4828 4104 iexplore.exe IEXPLORE.EXE PID 4104 wrote to memory of 4828 4104 iexplore.exe IEXPLORE.EXE PID 4104 wrote to memory of 4828 4104 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ipacc\HotVideo\pageerror.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4104 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5e32d02ce684c01ef3af05fae9066160e
SHA129c7a6e8ed553ac2765634265d1db041d6d422ec
SHA256b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71
SHA512e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5a874e4a9067e45db0ee225af0de7edef
SHA1c1b26d2d11a6fded5359b243149c80a3c8fc311b
SHA256c0261324cf387c9a365e103d288d618519981891c2e040ca635ef2793d1e46fc
SHA5129f905a6cf84a2d16013d879ad6785886366ed90162dc8d2b6d5d91eb05a062ca387f94edc8d82e7bd094010742cb8c780531d5a20eaf18fae6854cc069d655b6