Overview
overview
10Static
static
8MirServer/...er.exe
windows7-x64
1MirServer/...er.exe
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
1MirServer/...er.exe
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
7MirServer/...er.exe
windows10-2004-x64
7MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...rv.exe
windows7-x64
1MirServer/...rv.exe
windows10-2004-x64
3MirServer/...al.dll
windows7-x64
1MirServer/...al.dll
windows10-2004-x64
1MirServer/...er.exe
windows7-x64
MirServer/...er.exe
windows10-2004-x64
MirServer/...��.htm
windows7-x64
10MirServer/...��.htm
windows10-2004-x64
10MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...te.exe
windows7-x64
1MirServer/...te.exe
windows10-2004-x64
1MirServer/...��.url
windows7-x64
1MirServer/...��.url
windows10-2004-x64
1MirServer/...��.url
windows7-x64
1MirServer/...��.url
windows10-2004-x64
1Analysis
-
max time kernel
87s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:36
Behavioral task
behavioral1
Sample
MirServer/DBServer/DBServer.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
MirServer/DBServer/DBServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
MirServer/GameCenter.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
MirServer/GameCenter.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
MirServer/LogServer/LogDataServer.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
MirServer/LogServer/LogDataServer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
MirServer/LoginGate/LoginGate.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
MirServer/LoginGate/LoginGate.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
MirServer/LoginSrv/LoginSrv.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
MirServer/LoginSrv/LoginSrv.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
MirServer/Mir200/IPLocal.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
MirServer/Mir200/IPLocal.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
MirServer/Mir200/M2Server.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
MirServer/Mir200/M2Server.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
MirServer/Readme-说明.htm
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
MirServer/Readme-说明.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
MirServer/RunGate/RunGate.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
MirServer/RunGate/RunGate.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
MirServer/SelGate/SelGate.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
MirServer/SelGate/SelGate.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
MirServer/好服务端下载站.url
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
MirServer/好服务端下载站.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
MirServer/完美科技信誉一条龙.url
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
MirServer/完美科技信誉一条龙.url
Resource
win10v2004-20221111-en
General
-
Target
MirServer/Readme-说明.htm
-
Size
2KB
-
MD5
70f8e0a8f3cc2fb89704dc6ab1be4481
-
SHA1
8e29ae18eb8876b6cdfcd43d90fb8b703bd44608
-
SHA256
22f1a011a15cc161aa95e928b1821ff55de4a588b527c42e780a376a8c9bc224
-
SHA512
dd393fe80aaa014fea51e9cd15b18c95484b1646aa109d84a0a886cc8ee9ae5de74463a5c6236e02cb2888264a0bba7a05a5583266c266fa9bd232346186f8b6
Malware Config
Signatures
-
Detected phishing page
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998861" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001813654d01d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998861" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1666383778" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8CC92669-6D40-11ED-A0EE-EAB2B6EB986A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.haofwd.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376200930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\haofwd.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\haofwd.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.haofwd.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998861" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\haofwd.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\haofwd.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000095ff587c6230abdc365bf38e716fd4b2e0eca3d22e80cc05fff79350353655c4000000000e8000000002000020000000c6662c7d409cce47dccdfb104e9be22414305eb8a56970c67e2bb398534bb5ef2000000038956dee2f21808340f8f3dd788f3c50613c11cb78bba836d2db6d77d0d72b6840000000ac4c1d55639184cc10c22f0c9d8217f02664e5956c14d26b294b5fae0cb07cb655d106ed772ba9a14f71b6cf548833ca0ccc38c6b5c56345156d0b2415dd1f57 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1633885079" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1633885079" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4932 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4932 iexplore.exe 4932 iexplore.exe 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4932 wrote to memory of 2008 4932 iexplore.exe IEXPLORE.EXE PID 4932 wrote to memory of 2008 4932 iexplore.exe IEXPLORE.EXE PID 4932 wrote to memory of 2008 4932 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MirServer\Readme-说明.htm1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4932 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5a42abb21be3940a88a73771b18ed0f35
SHA1de12f2f619852ef135ee726614c43c2033ec5743
SHA256edaf1fb1f6ca2a0caf5f4d85b3f13507bd5df4971fa9ea8a6e08c1227f1ec667
SHA512c1f775deb2bcb2e0c48ed74dec1cd95f34690ca16d6465175d52d60ae45e746201cc608a58b6f8f080b7e6a7893993b61093c7d9ff63fa735ebaba61ddd0ebf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5ab9ede8481a1e22ef7f461a25c4f82cc
SHA13d54603bb6b169665ae25d83d9de7a9b5c939c77
SHA256ff0dcdd5cfb87c2f759aaf953e3cf298b736f43bf362e2142037c391e7b0434a
SHA512bb2363a8f054ee096dde3f715590c9db14d9bb7f443194b91a4044371dc1e19660074250899c2694ccd6aaa96a86d18e39a9036fbe86275e81bab459d1777aab