Overview
overview
10Static
static
8MirServer/...er.exe
windows7-x64
1MirServer/...er.exe
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
1MirServer/...er.exe
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
7MirServer/...er.exe
windows10-2004-x64
7MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...rv.exe
windows7-x64
1MirServer/...rv.exe
windows10-2004-x64
3MirServer/...al.dll
windows7-x64
1MirServer/...al.dll
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
MirServer/...er.exe
windows10-2004-x64
MirServer/...��.htm
windows7-x64
10MirServer/...��.htm
windows10-2004-x64
10MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...��.url
windows7-x64
1MirServer/...��.url
windows10-2004-x64
1MirServer/...��.url
windows7-x64
1MirServer/...��.url
windows10-2004-x64
1Analysis
-
max time kernel
175s -
max time network
287s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:36
Behavioral task
behavioral1
Sample
MirServer/DBServer/DBServer.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
MirServer/DBServer/DBServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
MirServer/GameCenter.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
MirServer/GameCenter.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
MirServer/LogServer/LogDataServer.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
MirServer/LogServer/LogDataServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
MirServer/LoginGate/LoginGate.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
MirServer/LoginGate/LoginGate.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
MirServer/LoginSrv/LoginSrv.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
MirServer/LoginSrv/LoginSrv.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
MirServer/Mir200/IPLocal.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
MirServer/Mir200/IPLocal.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
MirServer/Mir200/M2Server.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
MirServer/Mir200/M2Server.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
MirServer/Readme-说明.htm
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
MirServer/Readme-说明.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
MirServer/RunGate/RunGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
MirServer/RunGate/RunGate.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
MirServer/SelGate/SelGate.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
MirServer/SelGate/SelGate.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
MirServer/好服务端下载站.url
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
MirServer/好服务端下载站.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
MirServer/完美科技信誉一条龙.url
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
MirServer/完美科技信誉一条龙.url
Resource
win10v2004-20221111-en
General
-
Target
MirServer/Readme-说明.htm
-
Size
2KB
-
MD5
70f8e0a8f3cc2fb89704dc6ab1be4481
-
SHA1
8e29ae18eb8876b6cdfcd43d90fb8b703bd44608
-
SHA256
22f1a011a15cc161aa95e928b1821ff55de4a588b527c42e780a376a8c9bc224
-
SHA512
dd393fe80aaa014fea51e9cd15b18c95484b1646aa109d84a0a886cc8ee9ae5de74463a5c6236e02cb2888264a0bba7a05a5583266c266fa9bd232346186f8b6
Malware Config
Signatures
-
Detected phishing page
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\haofwd.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.haofwd.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\haofwd.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376204704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\haofwd.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{496DB480-6D49-11ED-9332-6A94EDCEDC7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.haofwd.com\ = "63" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1344 iexplore.exe 1344 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1344 wrote to memory of 1816 1344 iexplore.exe IEXPLORE.EXE PID 1344 wrote to memory of 1816 1344 iexplore.exe IEXPLORE.EXE PID 1344 wrote to memory of 1816 1344 iexplore.exe IEXPLORE.EXE PID 1344 wrote to memory of 1816 1344 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MirServer\Readme-说明.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD51b94d915494f5cde1daf5ff5073fc849
SHA1a223ed26ae708e6daae1904a90afd3d8faad1760
SHA256cc5c46439a3a12f6e1b3969bac3676087214598dd89f7d3d7f53b753df3ee986
SHA5123569dc699065753a137db1418a3efe172d153e383f7765faf8808a490c899fd0bc376697ad20d3089e76ee1ffe89f333944783290f729ada350327cce4ce823f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9881A9PI.txtFilesize
606B
MD51f4180874978f5573fd601570b2eed6b
SHA14836fe56359f1479cbf6301f4c1763f518f35a1d
SHA2566431ba81d9401db1faac74ce10c9d62238e066753809e19f9eb59c4b5679c982
SHA5126de3f37cf9c23b487a5e903682832ab94501aedfe3754b67dc0c2d8aee6dfc1c9d0fc5b70134f00093f55687717306960cb619908a44df0c24e5b5d8f8cb17c6