Analysis
-
max time kernel
152s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
中医院上网清单/材料暂估价表.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
中医院上网清单/材料暂估价表.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
中医院上网清单/编制说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
中医院上网清单/编制说明.doc
Resource
win10v2004-20220812-en
General
-
Target
中医院上网清单/启东中医院门诊大楼装饰工程(经济标).xml
-
Size
18KB
-
MD5
5aaa87cdd2ba1e426cb676d9878606fe
-
SHA1
3b4a1583e01bd51db92b63ddd31954fd6eb4bcbd
-
SHA256
fba33a678b55a93aea76d3f6095daf799456419c984d87f74ba9fe0ee45ca4b9
-
SHA512
20020bfc78f619729d5a0f440e8f2e981de0899c02deff0ce5c80917c28d61bd4b4b7130e72fc2b8e9866c2857db14434ac2df064fbe5493834c4f6678f0b39f
-
SSDEEP
192:JfJOYZKWcGkb2cBrBaBxQB2BZB0cBFvbQNNPrEW+EHO2Ek1eTiC:JItNlVQxyM//RiNPrEW+EHd1ed
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb000000000200000000001066000000010000200000000de59feff7457535851a4b7ba71669720f934cc244a494f2dab96dd678c8b78a000000000e80000000020000200000007286ac34c17e9712780e268a55524e005e50a4661ebc56f5420e021fd70e358a200000002b9adcdcf427d302363f4e1a36774b0f003c342dc59cc9ef17b923615814413740000000ea0dd10daec365d0e241b73bae04014ae76a1e59a1a9baf15b9900dc200c77ea96673890168c8d498dd210da912efc0ff38a6d6747ae1d9c2600a62b99fab141 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d2f07c5701d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb00000000020000000000106600000001000020000000fcbcab091da891ce05ea246329a57a448669daa11dd159054a72940218b4ce4d000000000e80000000020000200000006635cf8b53b5f0444e4ba6a2d4c0a06c2e119f1a8dd9a928bd94dd1a60777a98200000006aa46fe5614926246f4b8c6a1363dfee34f99fa490af195bd73b815de566f2e140000000c5aa9cb2f0fbfdae86759a7fca3f8b41ecdef94aa659801b45fe8cbd01d7ae1b2e26e39ec90f61ce537664d732945a65efd8123be80f7673c967e6a08f76f27b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A1BFABC8-6D4A-11ED-BF5F-7218A89707DE} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d3208a5701d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376205296" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1228 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1228 iexplore.exe 1228 iexplore.exe 992 IEXPLORE.EXE 992 IEXPLORE.EXE 992 IEXPLORE.EXE 992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4596 wrote to memory of 1228 4596 MSOXMLED.EXE iexplore.exe PID 4596 wrote to memory of 1228 4596 MSOXMLED.EXE iexplore.exe PID 1228 wrote to memory of 992 1228 iexplore.exe IEXPLORE.EXE PID 1228 wrote to memory of 992 1228 iexplore.exe IEXPLORE.EXE PID 1228 wrote to memory of 992 1228 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\中医院上网清单\启东中医院门诊大楼装饰工程(经济标).xml"1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\中医院上网清单\启东中医院门诊大楼装饰工程(经济标).xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4596-132-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-133-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-134-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-135-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-136-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-137-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-138-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-139-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB
-
memory/4596-140-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmpFilesize
64KB