Overview
overview
10Static
static
2006֮2009...��.htm
windows7-x64
12006֮2009...��.htm
windows10-2004-x64
12006֮2009...t2.exe
windows7-x64
102006֮2009...t2.exe
windows10-2004-x64
102006֮2009...il.vbs
windows7-x64
12006֮2009...il.vbs
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
2006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
1Analysis
-
max time kernel
67s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:38
Static task
static1
Behavioral task
behavioral1
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win10v2004-20220812-en
General
-
Target
2006֮2009ͨɱȾ/77169.org˵.htm
-
Size
4KB
-
MD5
e3917c7f4410faf63e3bdcfff5c33e81
-
SHA1
6848c2917ccc5e24578105ab31dcb23e451bcb10
-
SHA256
a05f31f26ce57b9e2d9bb6b242731186374c2a0b11d1723af7e107f2dac51ba8
-
SHA512
8b4fc3b9faa01722e49064f1f027f91860d0c7e6c8bffdcfe4465d6860857f0513784301902a10704684b8b706e9deddf0d39ad53db3f17ae09fee63eae7109f
-
SSDEEP
96:m1OQF/fRA2RWhwM6wIm4yRgJ/Snq6kVUVTWn0M9tJexGTHwG6ak:mXF/JA0Vde4JJ4jW0MH4xG0G6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000004dcf52f76f1bd0c9ab86119dff4b1a3667c5a1255c7d8462656fa99a17e6a080000000000e8000000002000020000000b0c2e52aca8f033b0ed6687764e2114788ac43fecc047b61c7e381aa5054eb1e200000001c4502ea5b0cf99dac9e7f509da75fa854e98044e66b099875e6d7bde95a838840000000280b92f9f09d51d14c0d59974f4dcfa20f54ba8f1c59384f90aa1e47add71d8d60cbfad8b89b34437726ef2d84816366db2ccf8c1e3e87f373fd54df1877e06e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qcloud.com\Total = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qcloud.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com\ = "56" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376462819" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5010D961-6FA2-11ED-B7DD-7E0305A911F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "56" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d84126af03d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000bfc6a6aadf43bfca0fe6241a70241fab6576bb6e9ea61563a7c9759a08afc78b000000000e80000000020000200000005196eb27fe387e730dacba02775e3e21fb069adcea4239ad01860fb62f5ed2109000000026d997c1d4bffe748ca8f7eb6fa64a410ad0e0300f272ec7cb1fbe362a55ce4b87a8873f179bfad8d7b7b0ced3bfed81b4ea2085c6046cde11529afe92b9902715f1bb81bbef8c5c786cdca656aeb2ef94ad04a0dc8625281135f12b8a29c0a1eb84222e6ebc3a5867ada2f51f18dcfbc8f6eff0ba15ff17b669c21351fbd76667f0175b0ed8da70767e23e52355c83440000000aad786de1745292f818f66e01936d102661f9c3962a9bf442a33eab481d1cfb7fc89fa73ebb573772dc24e21b5298d0c43f8de81a4a9a1e8f3b2a19e85b8c855 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com\ = "27" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qcloud.com\Total = "56" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\qcloud.com\NumberOfSubdomains = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1364 iexplore.exe 1364 iexplore.exe 660 IEXPLORE.EXE 660 IEXPLORE.EXE 660 IEXPLORE.EXE 660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1364 wrote to memory of 660 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 660 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 660 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 660 1364 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2006֮2009ͨɱȾ\77169.org˵.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58ec5723d50622dc70de14a09e720af92
SHA166a05ebd2ce8e231e7095f959929abf969940b72
SHA2560ac9a1097ee5cd4a12176127df5ae26c75277676b6faf14e1cf88059fe386cee
SHA5121d4833e58f85f4f237487a5587534e4af43eed0232a8f3ce8574246630c4e4d3ffe9cee6015614797df3e66ee2cec7491109464877317670cd6a7617d2501cb1
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.datFilesize
5KB
MD51448ba1e3751fcac685914971d04086e
SHA12fa01d82c159522b816d0cdf77960e58296006c5
SHA256a96797e4329c005f12cf9820229b1f22744a3a6e450367a263a5d29290c169fc
SHA512d3a85fd0a2e111e229bb61cda95cd8db36f89ed8491c468c213c52fe18265f94ed98d8051ab77dcfd1804c7fcb27cb046330d635963c1a19b8414630788f996a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZGD7KFID.txtFilesize
603B
MD5a479f21eb7e21c40fff96e10beca75c3
SHA1f8511a80c62451e96e438416d5eaac302ff80a6b
SHA256906c114eeff41b2564e8123cbf2798eb5d41f31e5a7afef56cec42bf503ded57
SHA512fcaba9ae01e51374c79b2142bc57595f03c7dd1309dd3c9ebafedf0fa2ad331b582319e7671f689d7bec3ed656d7cd10fef10fbfaa901f87b2294b05d71b2fad