Analysis
-
max time kernel
144s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 11:01
Behavioral task
behavioral1
Sample
Baidu_Com_90000215.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Baidu_Com_90000215.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ӛ-14.9.26.1.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ӛ-14.9.26.1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
QQ.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
QQ.url
Resource
win10v2004-20220812-en
General
-
Target
ӛ-14.9.26.1.exe
-
Size
1.8MB
-
MD5
55b9bb60c5b627b87f37cf89893d6412
-
SHA1
48c004c4f5ca9d22a0c69a22884ce6d9fdb486e5
-
SHA256
a03e2529a1b1e714c59ae4467b557140123c6631d8abad89c3eec6f9a4689506
-
SHA512
7a6de61cee3b2fa8526af15fd3acf985c1674a9dcac45f43d57fece3e59be6c2e04f7ca4d19d00bf4a2c30750bec37fd0c3d68ee8fef1385ebcf37adb8f70b2f
-
SSDEEP
49152:tjKs2rPHwcwUNaBeeSzn610EfuFfMxwg:4s2rPjUTS20V0w
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral3/memory/688-54-0x0000000000400000-0x000000000087F000-memory.dmp vmprotect behavioral3/memory/688-56-0x0000000000400000-0x000000000087F000-memory.dmp vmprotect behavioral3/memory/688-59-0x0000000000400000-0x000000000087F000-memory.dmp vmprotect behavioral3/memory/688-60-0x0000000000400000-0x000000000087F000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\pan.baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\pan.baidu.com\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376072306" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1318A281-6C15-11ED-8FA4-466E2F293893} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce58ad6b97c49a4683992dd2718f74b30000000002000000000010660000000100002000000037a79c159845c5873d86e68eea8ebaa818cec94ca3dcfc8c72fcf99ced8e39d2000000000e8000000002000020000000561507e749b6a2fbcf84e2fb2ba712126c209124c4950a0eedb1b78586258d2890000000b56c4d14acb41b292f12bd89b6ee5779ac9002ce46da47b50447bd1090b3898454dda4369265920fcfa06def1ba3296abd556eadb2c53859d1690838a719790f73a8b09dbb8786532f7d0efd529951ff2d0989b94742e385bcf0acac0ed8e3bbaf54f9217d32888f55f928efb8fabe4b02583280b25eee50690f38feacd1d09858eb98cb570805f1f901d38a9e3609be4000000098e473972bb0836d906721b2021e98681b798ecbcfe28e21c48c75303a2200a74fce35737887bd352ef435d9c7d03083cb919f0ba577cea225b25a6b6f8a2421 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce58ad6b97c49a4683992dd2718f74b300000000020000000000106600000001000020000000ee4668a07b4a5a125fb31a5ddc7047286c5b2104d0c48b568ba563b4732b314c000000000e8000000002000020000000e1756057ca6f0a42ef7660068e44495431b6de03c53dc2320ac7f6e38f4375e0200000008c2262efb0cbf30bff4f272cd0262b32fae0812139ef7fef1802b3f05859174b40000000416d7fa3d6e583491b6ecf14c3c3d5ef3033c9df018c30e632689581e9f042313dda7c5b75035eff3b41fcf751f4477d120eee3cd092f8952141d555412dc61a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e053de2100d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1172 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
ӛ-14.9.26.1.exeiexplore.exeIEXPLORE.EXEpid process 688 ӛ-14.9.26.1.exe 688 ӛ-14.9.26.1.exe 688 ӛ-14.9.26.1.exe 688 ӛ-14.9.26.1.exe 1172 iexplore.exe 1172 iexplore.exe 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ӛ-14.9.26.1.exeiexplore.exedescription pid process target process PID 688 wrote to memory of 1172 688 ӛ-14.9.26.1.exe iexplore.exe PID 688 wrote to memory of 1172 688 ӛ-14.9.26.1.exe iexplore.exe PID 688 wrote to memory of 1172 688 ӛ-14.9.26.1.exe iexplore.exe PID 688 wrote to memory of 1172 688 ӛ-14.9.26.1.exe iexplore.exe PID 1172 wrote to memory of 1656 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1656 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1656 1172 iexplore.exe IEXPLORE.EXE PID 1172 wrote to memory of 1656 1172 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ӛ-14.9.26.1.exe"C:\Users\Admin\AppData\Local\Temp\ӛ-14.9.26.1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://pan.baidu.com/share/home?uk=4066231292⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD537f8b91abc974639ba073e5320a314c1
SHA1ceae8e449da1c94249a9343985eedb8c3dfce5e8
SHA256d3af6fa70f72b644fa161217a5294658f736c729f26921064dcc9009f5845594
SHA51213849f258f489a6fdd4d4263270893da122810f5f24cffc956557897b26421880a683403a5ae28f971cb75701ec2f036e96c28f08fc09bc81226387eb8bfa4ab
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.datFilesize
8KB
MD559ae3fb0e81946c2363b0ac6f2f47766
SHA117b37e75fe260ba81e37f0e58d13ad74e1a72c69
SHA256c9cf5e385af4b6acc7b2600bae39db6f69ca32bbf0721a9ec2293e90c79cd20f
SHA5125c7ae81d7ec568355c27951d864aa5d53f8bea22fd8b47e9dcd259e65d9ea84d149dc89cb601f325246fa6fdf1b0e4b2fdcf3b721a672dfd1082206d3fcd56bd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6J1PJD1C.txtFilesize
603B
MD517acf3879027d031dd2078c1f4b0b060
SHA1f802d50e99bd9829c81b8173688ac16f35ed38d8
SHA256ba3f76d9c00461f209dcc162de63c257a12c25b5910896d7ea755a59e964c7d1
SHA512079342a5b637c421309464c93f67a22f1d6663a19bef9ce3767fc6e63aa580442fb8fc3ae6127d6ef36be98ca3fdc4b74c4cebb5bb7be145f5b5dfd4e7908ad2
-
memory/688-54-0x0000000000400000-0x000000000087F000-memory.dmpFilesize
4.5MB
-
memory/688-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmpFilesize
8KB
-
memory/688-56-0x0000000000400000-0x000000000087F000-memory.dmpFilesize
4.5MB
-
memory/688-59-0x0000000000400000-0x000000000087F000-memory.dmpFilesize
4.5MB
-
memory/688-60-0x0000000000400000-0x000000000087F000-memory.dmpFilesize
4.5MB