Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:42
Behavioral task
behavioral1
Sample
QQ网域帝国首页.url
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QQ网域帝国首页.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
网域帝国技术论坛.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
网域帝国技术论坛.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
腾讯cookis利用.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
腾讯cookis利用.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
视频.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
视频.exe
Resource
win10v2004-20220901-en
General
-
Target
腾讯cookis利用.exe
-
Size
1.8MB
-
MD5
ef465a19e8fb00180fe12ee2b4cdc27f
-
SHA1
8a9db7680d745939d233a1a6ca2472454e86288c
-
SHA256
d0fb60409eb0828a21c867c8e9b03bba9be4461907cebbdeae8433ade6e2fb6d
-
SHA512
e9a18f629e5a3b4bdbea1bc394f9e9d00b36b41d3bfa7ce19f25773e8161f46c86ff1b086f6a2b1fafbd051c8430b2f5ea908895d86587a8da5c4cc6b92204eb
-
SSDEEP
49152:Bj0eJBSzjBPQWP2qxOb1prKpKrVq+AbLsZVwm:Bj08mjBI9Fb1pZRsQ2
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral5/memory/1864-55-0x0000000000400000-0x0000000000868000-memory.dmp upx behavioral5/memory/1864-56-0x0000000000400000-0x0000000000868000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83ACA291-6D4A-11ED-977F-FAF5FAF3A79A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddbc871414712a4a8f732eabf407e6ab000000000200000000001066000000010000200000001b0d20a9f70c42f504a5610e2dd999e03349f54d3d4c85a179bef5c0651f916f000000000e8000000002000020000000ab62776e5b763646f0872b8e76ed4dfe61839ec6f9e4d2137bc23b4baae6457d90000000ce10346509bc96f5cbaf38ed0d352d4eea73101ce4566996493a6c845b34f7cb1a60fadd504ea79fa7fe084a5b128eee8874b525f2dbf5610d010709a497151e421c1fb5f07cc7db2179c68ff7b441e8f7d664f825415eb825ca80212eccaa2e6c50864a6893358849bf33fc2a5b568cc8bc2357cf9fae564ab64198edba8450b1d56e874ba06d0c203fa5f572f39291400000000846e45d291da029cae45fd31fb3d43aefa145b3a6a129c739fbac3d46931a77b8c4875799f4a195d6befd257b2e299509dfb300aa8e02b2362e4574d5d66d78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01190715701d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddbc871414712a4a8f732eabf407e6ab00000000020000000000106600000001000020000000ae8f468d440191c9ccef1444076e3653bba9484024dc6e906d0a2642f2e8ecb4000000000e8000000002000020000000b792279c30cf64dcbbfa482437f9eab9e0199169f3aaf9a2bdbd14391fde0fc3200000000749c766cb3223ec14be22dcb03ed6a9e5aa52ecf7909a71e0656b8281a2e1a640000000653ecf181e0b49740edb4410f26f99e62738909701ce272edd485ea3e055260dfd0bbef7e9ecb300bd229de43ab5a0474a0e26e07de5da2d499c253abea222ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376205214" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
腾讯cookis利用.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k28491018" 腾讯cookis利用.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
腾讯cookis利用.exeiexplore.exeIEXPLORE.EXEpid process 1864 腾讯cookis利用.exe 1864 腾讯cookis利用.exe 1864 腾讯cookis利用.exe 1760 iexplore.exe 1760 iexplore.exe 1672 IEXPLORE.EXE 1672 IEXPLORE.EXE 1672 IEXPLORE.EXE 1672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
腾讯cookis利用.exeiexplore.exedescription pid process target process PID 1864 wrote to memory of 1760 1864 腾讯cookis利用.exe iexplore.exe PID 1864 wrote to memory of 1760 1864 腾讯cookis利用.exe iexplore.exe PID 1864 wrote to memory of 1760 1864 腾讯cookis利用.exe iexplore.exe PID 1864 wrote to memory of 1760 1864 腾讯cookis利用.exe iexplore.exe PID 1760 wrote to memory of 1672 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 1672 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 1672 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 1672 1760 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\腾讯cookis利用.exe"C:\Users\Admin\AppData\Local\Temp\腾讯cookis利用.exe"1⤵
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.qqbangshou.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5b759a0a7bbd4d3dbabdad1c71c71886b
SHA1dbeb2c1fceed27012fd715da580be3fa3769fe2b
SHA25659ecaace1568fa6605d2e04c9fabc2d365f88fe914abf2181ef7e27ffdf09dc7
SHA51260e7987f2cf7a4654d9677e6c18df193c9a30ccd9f6c87440cdc726505a6c4376c36a62b69d5836ade713d0c0f5ee84adecaaa62f9493253818b225ec3e95003
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QH0V2Z0O.txtFilesize
606B
MD58627fe813600684e02bfd9cf02c0c6d0
SHA15d92a209a7d48de31fe2ae922428d8007f9ddfc2
SHA256dd10e3e305ef2d549eabdf63ecb9688350202e729bb4809a652d46d310c70bf9
SHA512e36652e1e4eadf24f7edf00c9d631320193f4543d3d847164bdffadf3e27189294b78ac321d859ec382954959a879f43fcd59c3e58f41cc70ff1fd1b12318995
-
memory/1864-54-0x0000000075911000-0x0000000075913000-memory.dmpFilesize
8KB
-
memory/1864-55-0x0000000000400000-0x0000000000868000-memory.dmpFilesize
4.4MB
-
memory/1864-56-0x0000000000400000-0x0000000000868000-memory.dmpFilesize
4.4MB