Overview
overview
9Static
static
jycms/捷�...pk.dll
windows7-x64
9jycms/捷�...pk.dll
windows10-2004-x64
9lpk.dll
windows7-x64
9lpk.dll
windows10-2004-x64
9sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...tor.js
windows7-x64
1sxw/admin/...tor.js
windows10-2004-x64
1sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...ut.htm
windows7-x64
1sxw/admin/...ut.htm
windows10-2004-x64
1sxw/admin/...or.htm
windows7-x64
1sxw/admin/...or.htm
windows10-2004-x64
1sxw/admin/...bg.vbs
windows7-x64
1sxw/admin/...bg.vbs
windows10-2004-x64
1sxw/admin/...ig.vbs
windows7-x64
1sxw/admin/...ig.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ta.vbs
windows7-x64
1sxw/admin/...ta.vbs
windows10-2004-x64
1sxw/admin/...dj.vbs
windows7-x64
1sxw/admin/...dj.vbs
windows10-2004-x64
1sxw/admin/...il.vbs
windows7-x64
1sxw/admin/...il.vbs
windows10-2004-x64
1sxw/admin/...rm.vbs
windows7-x64
1sxw/admin/...rm.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ly.vbs
windows7-x64
1sxw/admin/...ly.vbs
windows10-2004-x64
1Analysis
-
max time kernel
129s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 23:58
Static task
static1
Behavioral task
behavioral1
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
sxw/admin/Editor/Editor.asp
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
sxw/admin/Editor/Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
sxw/admin/Editor/Editor.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
sxw/admin/Editor/Editor.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
sxw/admin/Editor/include/about.htm
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
sxw/admin/Editor/include/about.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
sxw/admin/admin_bg.vbs
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
sxw/admin/admin_bg.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
sxw/admin/admin_config.vbs
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
sxw/admin/admin_config.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
sxw/admin/admin_config.xml.vbs
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
sxw/admin/admin_config.xml.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
sxw/admin/admin_data.vbs
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
sxw/admin/admin_data.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
sxw/admin/admin_dj.vbs
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
sxw/admin/admin_dj.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
sxw/admin/admin_email.vbs
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
sxw/admin/admin_email.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
sxw/admin/admin_form.vbs
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
sxw/admin/admin_form.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
sxw/admin/admin_html.vbs
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
sxw/admin/admin_html.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
sxw/admin/admin_ly.vbs
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
sxw/admin/admin_ly.vbs
Resource
win10v2004-20221111-en
General
-
Target
sxw/admin/Editor/include/about.htm
-
Size
1KB
-
MD5
1df3741f7e8f2f27cfb86fd10bd48cb7
-
SHA1
b07c4feb18b0d315a11ac2778e2e6ee7e0829ac2
-
SHA256
a4350f07dd66503f0e8b8fab36cacf69b42e77cd70ee3c454012bd9c0eedf9dd
-
SHA512
c94e695b8eee888337106d53d251988ebe536392e06c94c624310d20edd1c642f58d4246f1b2dc2dd9bcdf26d1546bc545883efcb129709befb4d593ef485d53
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bccceca3bc14d343b20b65f43b787c3000000000020000000000106600000001000020000000223f48bc3bd87c79d9b70f18f37ad01204cb6fcd8cdf69981a307901935b5fe0000000000e8000000002000020000000d5394abb249ac5b956608cf43af8d2b0ce572477f48d5c168e64ec36c6de03102000000014f036e39cfb99c6e80368623b6696672bada067b45d42acca3a1a9750b7d23b4000000052a88bf3fe8e9217ae9b3c5901533ea95f8a5c4b36d953e664dc5e676a43a4d2cc3da534d969c2fb93b66a6ad28ebe8cb228f95fab8c5fdedc48dfac6543ef46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74A933F0-6D84-11ED-A964-EAF6071D98F9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bccceca3bc14d343b20b65f43b787c300000000002000000000010660000000100002000000039ceb75c4b7a539e0108d549d9ccb7916c5501d9400e9bed6995ee0fa1cf2af2000000000e80000000020000200000005e6bb9152ae4d698711b632e25e84db1efb9460e8d94e87b98986a4c9e506c7290000000f2ac394491d38e459f21636f87ee19c217b862b1281aba0c973237269efa036a9efe49aebab2210c12d94c17e36416ad0864a860a5ca680cab047fe2bf5fec90184eb3fdd2135f5424ae05c954eb2433023acc317de44e4a7758e152c1854bb703845c802e62adbc0b3268dc7b19f13e34b8be004ac0614551171a302454e48d615e83938733bc5b7b20973a3e5ab7bf400000001c1347470d8a79e49de71bb7e2b9393761b57055f3bd0b7bc956a037a79b4eb1274003172174a7a388c3b13244df799a8cc1bbae4574c85073884e0ad0dba141 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404bb5609101d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376230106" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1112 iexplore.exe 1112 iexplore.exe 952 IEXPLORE.EXE 952 IEXPLORE.EXE 952 IEXPLORE.EXE 952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1112 wrote to memory of 952 1112 iexplore.exe 27 PID 1112 wrote to memory of 952 1112 iexplore.exe 27 PID 1112 wrote to memory of 952 1112 iexplore.exe 27 PID 1112 wrote to memory of 952 1112 iexplore.exe 27
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sxw\admin\Editor\include\about.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:952
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606B
MD5028ad52ca4900b87d55c4cc3b19141bd
SHA1f0a0c3c84a299d54e3a3b2a2ca322f4a4a838a82
SHA256b78c237f2e46723107bc05a81983dbfec0a93264e1ae808e069b53b87940943b
SHA512af05773867f9b0a86f48580b32df83b6bc097589706d608125a45444f2e6ed581ff9ebd79ea5c5dde517abc9018ee7e496b8dfd8533032c23ead94bb5fd2d4cb