Overview
overview
8Static
static
8U盘启动...ol.exe
windows7-x64
6U盘启动...ol.exe
windows10-2004-x64
6U盘启动...er.exe
windows7-x64
8U盘启动...er.exe
windows10-2004-x64
8U盘启动...�.docx
windows7-x64
4U盘启动...�.docx
windows10-2004-x64
1U盘启动...SO.exe
windows7-x64
3U盘启动...SO.exe
windows10-2004-x64
1U盘启动...ge.exe
windows7-x64
1U盘启动...ge.exe
windows10-2004-x64
1U盘启动...��.htm
windows7-x64
1U盘启动...��.htm
windows10-2004-x64
1U盘启动...��.url
windows7-x64
1U盘启动...��.url
windows10-2004-x64
1Analysis
-
max time kernel
101s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:37
Behavioral task
behavioral1
Sample
U盘启动制作工具包/FbinstTool.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
U盘启动制作工具包/FbinstTool.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
U盘启动制作工具包/MsgDiyer.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
U盘启动制作工具包/MsgDiyer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
U盘启动制作工具包/UD启动界面编辑MsgDiyer及FbinstTool使用图文教程.docx
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
U盘启动制作工具包/UD启动界面编辑MsgDiyer及FbinstTool使用图文教程.docx
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
U盘启动制作工具包/UltraISO.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
U盘启动制作工具包/UltraISO.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
U盘启动制作工具包/WinImage.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
U盘启动制作工具包/WinImage.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
U盘启动制作工具包/好251网址导航.htm
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
U盘启动制作工具包/好251网址导航.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
U盘启动制作工具包/绿色资源网.url
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
U盘启动制作工具包/绿色资源网.url
Resource
win10v2004-20221111-en
General
-
Target
U盘启动制作工具包/好251网址导航.htm
-
Size
129B
-
MD5
94b399885ae5f164d5c4bdf3c1d04b7a
-
SHA1
b8c008c38e11e539903b089d60300347610543a8
-
SHA256
abc13792a08764fd2a4728478c1b8e607f50cbb1149cc225263ce276587befc7
-
SHA512
c137cafc230c32353a89d79bdeaa63113be42585176e60b2aa79148d1410fb4a9529254fc885c02553fc20d4df536cef20553ea6f5088e70037a882c852ac459
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E67690B1-6D73-11ED-8EAC-767CA9D977BF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000002f390b815cc511afba0c8c059df26574222e78ab8622009458739f5c272840b3000000000e8000000002000020000000824fd1e77784a79bf322949efe70aa51ef9078ba3689ad7b4da63054d48a56e29000000086ca99170f2d8d2ad54863f256cc54dc2c2035a5cf906a5038fdd33226d88cf54ab396cbe8caa81d6f8aa3f6ec17b676df2e93831a4fa71aa25764f995d396de40ed2eb6bc4b5bc656ee2039ee231ca83d0861b8513e4196816e31aba96fe762505635641c851845d50a5352590948740dbdf20d4ccd06a2ee53c372450a8039e04e688956eb07dbfba7d9781df4d3af40000000bc2138e7ceb669a5cbf729154ee40415baa7304fb81d35cf1a56c4495363e6354bc6cc051b3897bd497acc63f9c3616b7fdf8afa8501e842e9d4ab3e289ad07a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000005a08cae184c459fefce420854736e9062a8f4a0251fa14a8328dcdfcd09f3008000000000e800000000200002000000095763556177c566145606c4b44d3754bf3e3348e1da71b8ff268082134fbe4cb20000000ae373d1a81dbd984c3ae1206d6c9b6d232bb375876f750e24971922a68c476ae40000000d1125bed15a8324234de70368b97b835283b9667bc638c07099f3edfe48d5f74b276bb8caaae42f9b25d0d2b73d86c4b072991821d9e85e2364ac11de97f8737 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376223004" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709d88cb8001d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1808 iexplore.exe 1808 iexplore.exe 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1808 wrote to memory of 1028 1808 iexplore.exe IEXPLORE.EXE PID 1808 wrote to memory of 1028 1808 iexplore.exe IEXPLORE.EXE PID 1808 wrote to memory of 1028 1808 iexplore.exe IEXPLORE.EXE PID 1808 wrote to memory of 1028 1808 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\U盘启动制作工具包\好251网址导航.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD564a370aa347c31274f2cd5b81ef76dea
SHA1d48440594efdda1babf09ac05e65cf9c2dda8c10
SHA2565659633fa6bd1ee20639f88a1cec87e20d216f27b09b5ff8add4871fe154fe2d
SHA5121e39b2e5097bf8f048490b24670c6ef40dd1f556f65ef1b27ba449c5eb5ddd381568225a188235ff1f4fd4fc5076e715741dcddaf6cf2aa8d9a1f98e1e1f4d50
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.datFilesize
1KB
MD5dd560b8ffdc2857c7675a24821dff31f
SHA1f2376e6f49580876bfe0f5302c67975afe970da1
SHA2569f5b295f0aa14d68da3c98587fd93502678cbfd0b93e12b98b132eeec8e5ceff
SHA512d09d05c9206964b12cb9a1bcbf979c65801a8d8e9d17b2966921c2b5542d014ee87bf735bfdcaa9112764c41d798d9ce2eb53dd61bc0c09867bff43fb5e4b156
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UBQCJE4R.txtFilesize
601B
MD5472c4e81259730265c867a684274e166
SHA1167aa125ee68d4949b990b5c0e109c785221852f
SHA256a587a1407c82bf826e2378ae50631c3bd37bd327c03a0a09b0b5ab776e391945
SHA5121a4135f0b39257d6218f6b40b8f723fdc57bcd00c90df6a3bae3d002a6a3679b59db14226ab7ec8defe86ab6c3a4a66aa027dad847c94c0ecef35ded6b78a969