Analysis
-
max time kernel
110s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
中医院上网清单/材料暂估价表.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
中医院上网清单/材料暂估价表.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
中医院上网清单/编制说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
中医院上网清单/编制说明.doc
Resource
win10v2004-20220812-en
General
-
Target
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
-
Size
18KB
-
MD5
5aaa87cdd2ba1e426cb676d9878606fe
-
SHA1
3b4a1583e01bd51db92b63ddd31954fd6eb4bcbd
-
SHA256
fba33a678b55a93aea76d3f6095daf799456419c984d87f74ba9fe0ee45ca4b9
-
SHA512
20020bfc78f619729d5a0f440e8f2e981de0899c02deff0ce5c80917c28d61bd4b4b7130e72fc2b8e9866c2857db14434ac2df064fbe5493834c4f6678f0b39f
-
SSDEEP
192:JfJOYZKWcGkb2cBrBaBxQB2BZB0cBFvbQNNPrEW+EHO2Ek1eTiC:JItNlVQxyM//RiNPrEW+EHd1ed
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376205202" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d29e552960fb8d4b9915dab85eb828a400000000020000000000106600000001000020000000e6f20dffb670894cc63958aea3d437772223c9f7d59b632e21d8c53baaade5cc000000000e8000000002000020000000d07facf7f9413a1ea601d1c58f192799670d2f22622440bbad135f19ec8d814120000000dc4a5f79b11b869908bcf18e84078bdb939f5556b43a10195d49a4df7ee4610d40000000ca28cad9bc531dc7d60520119fb6361bb78a1e2c1cf44c6c0b89afd7505513e67d67d6aba9de37e6d5f4dfade58c8e2c85bdbf4dca0cfc0215386854be2d50fd IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08c3b515701d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC67F71-6D4A-11ED-BD75-FAF5FAF3A79A} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d29e552960fb8d4b9915dab85eb828a4000000000200000000001066000000010000200000009ad774b0523d49bc5ccdabe2953d33d738da61f04441761c415c556ba09c0f39000000000e8000000002000020000000a0400dd9c2d71893cd288994b73f2d7637f43184ea1d20abfe51456b7079459490000000e6c2697351995d33578b2d6c34561540d7c1005605be57dd771d6d67eacfb14619848a1073040d78724ef675a7ef46b8401bf07315d8710da9f183faa314d2a8218fa6a6f223cdb42967da99363b0e4601c69d9c39a5d6ffcea0a093d20bbaf85c2145cb1e6744b0c11fda395110eb15c8b272d9ca5566ac981671de0191eef74829f62ac6d916263850355f86e9e5d64000000086cd5d5763e12bb123c27640c5e0937b31ac33b28b4550340f7be6fd86ed0620a28e00dcf41a120e60f16f24e50419e6b4ca2858a33e4a20e7ccdb6ed1c14643 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 956 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 956 IEXPLORE.EXE 956 IEXPLORE.EXE 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1944 wrote to memory of 1700 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1700 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1700 1944 MSOXMLED.EXE iexplore.exe PID 1944 wrote to memory of 1700 1944 MSOXMLED.EXE iexplore.exe PID 1700 wrote to memory of 956 1700 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 956 1700 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 956 1700 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 956 1700 iexplore.exe IEXPLORE.EXE PID 956 wrote to memory of 1472 956 IEXPLORE.EXE IEXPLORE.EXE PID 956 wrote to memory of 1472 956 IEXPLORE.EXE IEXPLORE.EXE PID 956 wrote to memory of 1472 956 IEXPLORE.EXE IEXPLORE.EXE PID 956 wrote to memory of 1472 956 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\中医院上网清单\启东中医院门诊大楼装饰工程(经济标).xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X0HX1V1Q.txtFilesize
608B
MD500aa8c17f22f2c94b392ea2e017c23df
SHA1c0bd4fbab06c9a7e8c8c2f7270ad8378d0538ca5
SHA256d7c23f868c5e31671b39e34765fbf3247c2f3fee382ed6d4f31ec0d20b94ce3b
SHA512e6dfb14975743cd992748f82756d4036d8fba8bc0ad7e18c9fc89d84311f817879a4c160f061847de761289c04daf58ef62e531ff695d4951c6aec493a415420
-
memory/1944-54-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB