Analysis
-
max time kernel
117s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
happygame.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
happygame.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
使用说明.htm
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
使用说明.htm
Resource
win10v2004-20221111-en
General
-
Target
使用说明.htm
-
Size
2KB
-
MD5
f167320d5d11be52e7332b943ccf0bf8
-
SHA1
aa265bc6fb9043ac4729a5bc8aca338be0022e2c
-
SHA256
6cff52f54f3d9c0de6e0b231d3cc06a4ea8ea4c15fe19e20f57da2ad77369bd9
-
SHA512
f94dea5edefe16b06c7fe2366ac24001fc7ffd709a5971bae9bee5fc12164310dfc460c733ab48f83396dcde318d7948ff961d007bdbc78bcd8aa9a9101c899a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505a4176de02d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb80000000002000000000010660000000100002000000082357639339c31683c4c9108dd446fdd1a740a157d194bc96c71c2fc608e5da4000000000e800000000200002000000000df5ce11856b9797ef614a2b614685242e1cde517e5bd2203aa3d7eeb00ca229000000063068afb244d781fee5309f67d1520bdfefd14baabbac8727f26522af1176f001514c4ed1d744e9cd4159a726ed53c13f06061ba89c33fa41d9481a3ebe340b715c9a94acfb931f58f4856211e08c568a4191539f5586527ed5514c97bb72dd27940ea1b3c1054b3afe3e8449a827366352cc3a8122ba605f7ebbabe395c2c38d591cf92e4651f9d38cdc4077ef11d6340000000d7a3285d85b4d62890a5ed53d4b9b5eea81f41e7e437413646de5d4a270a241ea71b44414ddd22afcde8e915c7f45dbd48a16bc0c949a3e75630f1aa45777fad iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376373189" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb80000000002000000000010660000000100002000000056974097f63d1ff66cb1f216cce350d63c6b1285c30585e8b0a9fd2b243bdbfc000000000e8000000002000020000000ed25fcd0cc7c7de64988cd7e9f4833f0d7b7f37b74fb8dfd0b90df67313fe42e200000005c1526d59a683ac08a7e58257be9d92471abf79f7e43985a6de13a77f889255940000000d08ed939bedda7540c36b3033f4796c03a5b971f04fc46c9c321c2e7dedf6d8210015f89322a64ea0d0cdb6c3520fd4874618726e43d50692626643b7cc12138 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A087E451-6ED1-11ED-AC54-767CA9D977BF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1236 iexplore.exe 1236 iexplore.exe 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1236 wrote to memory of 472 1236 iexplore.exe 29 PID 1236 wrote to memory of 472 1236 iexplore.exe 29 PID 1236 wrote to memory of 472 1236 iexplore.exe 29 PID 1236 wrote to memory of 472 1236 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\使用说明.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba78a08684beb19d975f60d7abc5a8c1
SHA1596c9960124c43343a7d1e699545f5e602d683c0
SHA25676ceffa42e8a3b3ddd0f6284a11404a71a3c70a6912b688268427fc202d8ab2b
SHA5126bc00901aa6c770e1c6156222e0cdd3c4a4a02bc24f5305f83fc81f3fa765d2e86b0deff9412dde49dc64284257fa604cab2cb6182afeadfbd6e02b1db846fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c209dfeb8b0a2b8b25e13fd7f2109849
SHA1b18fc3a10a31f895d2c52d0f2520ddb4156c67b0
SHA256e73cf4c57ed68e6c16bfd4e08b700e6a4c564fffb65195fe25eaac798ba04d34
SHA5123b390c851c4bbf167183e2e902c6001489311ccff87df89d8263f1d327d1487cb928648d0b1fbc26a1c66bcfac27e74757927a9a76c77fce8a4e043ed5ac20fd
-
Filesize
608B
MD5b5bae673b4d2b99d1ba094bf11c78af3
SHA103f3ff3d4f5fb2bcacc0820b4249e23d60a01ebe
SHA2568923d6a6cf6f440f64e0143fbac92c5f62d443a61871ef4cbbda285f0eeab47f
SHA512120cda5617a4540c9df4b717cc78c6ecea666dc14e71ad51769a7e07a4d4cd073620975f0a6d69a8ae256441d16ddf65c922d3edc517a7fd3c230ef5a49f32c4