Overview
overview
7Static
static
ipacc/)!�...��.url
windows7-x64
1ipacc/)!�...��.url
windows10-2004-x64
1ipacc/HotV...r.html
windows7-x64
1ipacc/HotV...r.html
windows10-2004-x64
1ipacc/HotV...t.html
windows7-x64
1ipacc/HotV...t.html
windows10-2004-x64
1ipacc/HtmlPeek.dll
windows7-x64
5ipacc/HtmlPeek.dll
windows10-2004-x64
5ipacc/iRes.dll
windows7-x64
1ipacc/iRes.dll
windows10-2004-x64
ipacc/index.dll
windows7-x64
3ipacc/index.dll
windows10-2004-x64
3ipacc/ipacc.exe
windows7-x64
7ipacc/ipacc.exe
windows10-2004-x64
7ipacc/ipacc_v2.dll
windows7-x64
1ipacc/ipacc_v2.dll
windows10-2004-x64
1ipacc/ipaccu.exe
windows7-x64
1ipacc/ipaccu.exe
windows10-2004-x64
1ipacc/ipla...er.swf
windows7-x64
3ipacc/ipla...er.swf
windows10-2004-x64
3ipacc/ipla...yer.js
windows7-x64
1ipacc/ipla...yer.js
windows10-2004-x64
1ipacc/ipla...ect.js
windows7-x64
1ipacc/ipla...ect.js
windows10-2004-x64
1ipacc/istat.dll
windows7-x64
3ipacc/istat.dll
windows10-2004-x64
3ipacc/jifeng.dll
windows7-x64
3ipacc/jifeng.dll
windows10-2004-x64
3ipacc/说明.url
windows7-x64
1ipacc/说明.url
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
ipacc/)!访问我们的网站!.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ipacc/)!访问我们的网站!.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ipacc/HotVideo/pageerror.html
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ipacc/HotVideo/pageerror.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
ipacc/HotVideo/pagewait.html
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
ipacc/HotVideo/pagewait.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
ipacc/HtmlPeek.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
ipacc/HtmlPeek.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
ipacc/iRes.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
ipacc/iRes.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
ipacc/index.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
ipacc/index.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
ipacc/ipacc.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
ipacc/ipacc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
ipacc/ipacc_v2.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
ipacc/ipacc_v2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ipacc/ipaccu.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
ipacc/ipaccu.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
ipacc/iplayer/iPlayer.swf
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
ipacc/iplayer/iPlayer.swf
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
ipacc/iplayer/iplayer.js
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
ipacc/iplayer/iplayer.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
ipacc/iplayer/swfobject.js
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
ipacc/iplayer/swfobject.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
ipacc/istat.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
ipacc/istat.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
ipacc/jifeng.dll
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
ipacc/jifeng.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
ipacc/说明.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
ipacc/说明.url
Resource
win10v2004-20221111-en
General
-
Target
ipacc/HotVideo/pagewait.html
-
Size
1KB
-
MD5
ada8bc44e180ed72ea3e1870623a6c54
-
SHA1
383da689dea5884310eb80e8fdc7760a64fac002
-
SHA256
4c728e6db57f4fc6bc63a7e5e9e1662a0dcb30822300b1ee66d0ef1abe89bef8
-
SHA512
8e5e4c8c117bb55daa1b21af42441676e561900df4926c408bfba2a4505ecc5f23b483023120db1aa55cf666c4b5547881017f650bb1ebbcbf00b95a0123d962
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c2fbaee8ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998504" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376047723" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2866680447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2866680447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998504" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9052d3aee8ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000007f967bbb3b3cc9da693dc8904d2669aaf793ac9cc45f7862d4e53a3f2043e775000000000e8000000002000020000000b17e3d39302ad93b6cef5b11b1ef2554aa57635ee7f087ea3eb9a2e46e410b87200000005567324808988098ddc981ad30c99129ada1c2312a021e2502198259b9d002bc40000000cc391091cdd2c13d41524d3190dcfa44a4b90eede51b4c0a70ab85cb078f3ce6ce59cc46125bf0b75a493f9e20aa89575b7558031e8b4f3b3183e3cb6358ea85 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D6499D71-6BDB-11ED-A0EE-DE60447A8195} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998504" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2906369827" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000a9a92f7299aaf449945a1450c0977eeb3c33313b1754bd949ae3a8d8ee5996e5000000000e8000000002000020000000d1be54ffa23e63564482120e26dc3062b40e33aa06a6bfc942ce554e362d8e73200000000fc4b501d3ed6cad4bf68849b01472d5cb31712104a665c9ee7c96aef1b0e48d400000000d45a51e60b028822e666bfae1f49fb7ec67123f77c95db7e924923b203198dab467e652eaf9402da27eace42f899adedfca8c7c8a2f10264cd878c14b2091b5 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2836 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2836 iexplore.exe 2836 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2836 wrote to memory of 2704 2836 iexplore.exe IEXPLORE.EXE PID 2836 wrote to memory of 2704 2836 iexplore.exe IEXPLORE.EXE PID 2836 wrote to memory of 2704 2836 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ipacc\HotVideo\pagewait.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5e32d02ce684c01ef3af05fae9066160e
SHA129c7a6e8ed553ac2765634265d1db041d6d422ec
SHA256b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71
SHA512e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD52bdd5eb4730673085623f71057cc2d7e
SHA17c9bda215f3995cabb609bf95c24ce9006887828
SHA25618ce3975562aa570a50a993bb62d190723a622188b9c8e203cb210437dde6bb7
SHA512664a637293a65a46dfa9ba9b5f6447905c84a9133551c8b48cfaad0e4399ca83248239154ac27d8a31a3c7b7d8eef313c7d6a0b2d7ddd368b71f168eed13a0f1