Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 11:22
Behavioral task
behavioral1
Sample
wjj11.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
wjj11.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
使用说明.htm
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
使用说明.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
小游戏.htm
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
小游戏.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
常用软件合集.htm
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
常用软件合集.htm
Resource
win10v2004-20221111-en
General
-
Target
使用说明.htm
-
Size
1KB
-
MD5
11f9b79e1dd88bc67967b5d65c2f0d00
-
SHA1
9152dbf2c9a76e0a3ce355e73ebc95c2405a384e
-
SHA256
a0c87ad3fcd851480dc1133bf229b6f4bb582b0584cda05e26b86495225f336b
-
SHA512
8adb8f3f5441ae310ae89e7067db57576e831332bbec5a0afa3bf82ef843e33f0c28aaecd1d69b7e022a91554d3a79876ef4f3c53c79c999f13c27c65fcefce5
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000074a490bb1f95fe163591d9420eaf2fd949fab586f50b174e97ea51087ab72c63000000000e800000000200002000000011da54e44d6f0e4c1f8a7ff95bacc6bc2fed0807742b6e4a351c160668cc9cbe20000000e4026c4beb58fb8544ba9d0a147257f36cde551397fff44e3a9a9d17ff9c5c9440000000dfbacdb46b05e7fd29ed552ff2b4f17b37cde1f1f06eb4faffbb45b973facc5c6965be702843c8fad43387881d159c5cf6547edc65b7d858029351402acd7540 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503d0388ff02d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376387409" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCC5BD11-6EF2-11ED-A45B-DAC72961D548} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000c382134d6a6e898d8bdd33592a42d9035f9b233ac86b5970c8fd071670c493b9000000000e8000000002000020000000b56d309d0a950753d9b40f0a95b9cc95aec9904aed271a8657b6daced3639db390000000191da85ecb87623b66844bef0c9a63df852f4445b5dc21462401fc6008720e608fe8792d4d7a9f8322da105efc9bd854e62649293c8613ffd7d36cf7b06179c184dfd1a817b50ff5821fed22f4c339667628adaed311ba48dc98357f7c611ad5829c9011238830b4ba44efc3ae691d91c9eb5be7eb5cdb7282719443629ee6e7e08b9293cce7ed248ae091bf90684776400000002010eb8e4a2752c2d823053b2e7ea7dee071fd028d07a2ae5c45696f0a1fad508701ac1422fdccd6cbdbd536556f0d3bff5ba54a0feab1bed5c84ac6b81a42e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1288 iexplore.exe 1288 iexplore.exe 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1288 wrote to memory of 1104 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 1104 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 1104 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 1104 1288 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\使用说明.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cc205a1849de81c95fcb5793ace11639
SHA196b23f024f7c93e672930a496185c4fc829c60e9
SHA256fd2396b2558f8b5c95d94ad88053e9696d1334a1cd5c6b67248eb148c6963b07
SHA5125a4ab302003e986b8da616b82ec33a3d45c351dc5b616cd96b3339d6d44bef0e5cddd6863ab95649504bfa5700d2b74610b00af53a8ba6acfbccf976acdd5584
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3S768NP1.txtFilesize
608B
MD5bff311ba5a7b4492a4d65c108659b560
SHA1bb64ae7ebce3167711a08620d23bb3323661840e
SHA256382a0aac1acafbe64c12bd8ce495055721eb7c1aef2921341b9be752fd68a4d6
SHA512b279b1446be81cc86c75d6c30caed0ef970a304c9b02943f020e09d62741cb65fe6c94576406dce5a6aaadc9f0e1a84d92dd151ac0c309cf3e1c2258fa7a4717