Overview
overview
10Static
static
2006֮2009...��.htm
windows7-x64
12006֮2009...��.htm
windows10-2004-x64
12006֮2009...t2.exe
windows7-x64
102006֮2009...t2.exe
windows10-2004-x64
102006֮2009...il.vbs
windows7-x64
12006֮2009...il.vbs
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
2006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
12006֮2009...��.url
windows7-x64
12006֮2009...��.url
windows10-2004-x64
1Analysis
-
max time kernel
99s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 02:38
Static task
static1
Behavioral task
behavioral1
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2006֮2009ͨɱȾ/77169.org˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
2006֮2009ͨɱȾ/Project2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
2006֮2009ͨɱȾ/qqmail.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
2006֮2009ͨɱȾ/ĺڿͬ˽ѧѵ.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
2006֮2009ͨɱȾ/ĺڿͬ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
2006֮2009ͨɱȾ/¿ƼIDC˾.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
2006֮2009ͨɱȾ/¿Ƽȫά.url
Resource
win10v2004-20220812-en
General
-
Target
2006֮2009ͨɱȾ/77169.org˵.htm
-
Size
4KB
-
MD5
e3917c7f4410faf63e3bdcfff5c33e81
-
SHA1
6848c2917ccc5e24578105ab31dcb23e451bcb10
-
SHA256
a05f31f26ce57b9e2d9bb6b242731186374c2a0b11d1723af7e107f2dac51ba8
-
SHA512
8b4fc3b9faa01722e49064f1f027f91860d0c7e6c8bffdcfe4465d6860857f0513784301902a10704684b8b706e9deddf0d39ad53db3f17ae09fee63eae7109f
-
SSDEEP
96:m1OQF/fRA2RWhwM6wIm4yRgJ/Snq6kVUVTWn0M9tJexGTHwG6ak:mXF/JA0Vde4JJ4jW0MH4xG0G6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2318732928" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500b05a5b703d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999479" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qcloud.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999479" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2318732928" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B3646A1C-6FAA-11ED-AECB-C2DBB15B3A76} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "56" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com\ = "56" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a5552448c4c67d4696c84b76bc7b3f5b000000000200000000001066000000010000200000005226a0df6cd65f285a79e610c3da34e061e891938bf82e6f30c72d7a329d4f95000000000e8000000002000020000000fe151bcf7f57c0ef0ba8ade30390548b719dabc8ed4610a4cfbb1fe8aa886cce2000000099595de57de8c02735617d5031b6b9cd716c7335f63a423a19cd2e0eb1c1af4940000000fa2dacadef91f17d98bd66d034adf9505b4b7a458e1dde82d2577698a7a64856908580c63aa37828519ba5bfc08f652e70a79de4ccbc7c25f15df29f44ec1a78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qcloud.com\Total = "56" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999479" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2490766341" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qcloud.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376466442" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dnspod.qcloud.com\ = "27" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qcloud.com\Total = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\qcloud.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 5104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 5104 iexplore.exe 5104 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 5104 wrote to memory of 2524 5104 iexplore.exe IEXPLORE.EXE PID 5104 wrote to memory of 2524 5104 iexplore.exe IEXPLORE.EXE PID 5104 wrote to memory of 2524 5104 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2006֮2009ͨɱȾ\77169.org˵.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5104 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5dedb504b3469b24ec0df79c68f5772e2
SHA1177a8b1045b456316ca32d90aba942bf34774c64
SHA256e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0
SHA512101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD59ea380badab2bc7c8fcdb7031fd061cc
SHA17e765008b34b9f61de5a5a25794a95513cd00f46
SHA256808dd3f34cb55b5f825b6bb96589ad1768b2d98b8b96eab75ed137a23125802f
SHA5120bd1b39b15b77012f16dea48b0e971dbc943d4fb7a7291f9b17463b53249878bea5f6d18f703d69ae2d0febb98d1ef5e338f364cc26ba1dd4277f5f47365cd8d
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.datFilesize
1KB
MD5cc93d3358d94475b3473ba99ed1c562e
SHA184506676cd058eb48640d16e973efde43e8a6542
SHA256900cc909d26415dcdf197d4ba73aba42d5891d41c004c3a4e8f45a0c0849e2fe
SHA5129023894d99fd3511ebba2791c6ffc3365068413629b5642be2b9078f8feaf61f53ce1402dc745e2ba2b1d895715d2e963ed2be511bc68cd4371ad60b2cb83b69