0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71

General

Target

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Size

2.5MB
MD5

bab923da922c592e4138b88a402add32
SHA1

5927bed5f9a41a82b6c5b91175ef5bb396a1f17c
SHA256

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71
SHA512

6c74a6ab914d4f5474450f223020e49658dca756a7769329ccd23d2560121d212474382541a022533b19d5acb5693d2a2576134aafa47ff1f4ab2aa5088c87b7
SSDEEP

49152:VSVJcb9RglAw8js3duEFxNWwKhvzJWNNERSxgNVnJ/hewok+hN6mDKU:VSaIA/stWwkvzJWn+ygNVndhewok+hN3

Score

9^/10

cryptone packer upx

Malware Config

Signatures

CryptOne packer 3 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
\ProgramData\Msgbox.exe	cryptone
C:\ProgramData\Msgbox.exe	cryptone
C:\ProgramData\Msgbox.exe	cryptone

Executes dropped EXE 2 IoCs

Processes:

CF唯爱稳定透视十字准心稳定版09月22SP2.exeMsgbox.exe

pid process

1788 CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1712 Msgbox.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1184-55-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral1/memory/1788-65-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-67-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-68-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-70-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-72-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-69-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-76-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-74-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-78-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-80-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-82-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-84-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-86-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-90-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-88-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-92-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-96-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-94-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-98-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-100-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-110-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-108-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-106-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-104-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-102-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1788-114-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/1184-115-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral1/memory/1788-117-0x0000000010000000-0x000000001003D000-memory.dmp	upx
\ProgramData\Msgbox.exe	upx
C:\ProgramData\Msgbox.exe	upx
behavioral1/memory/1184-122-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
C:\ProgramData\Msgbox.exe	upx
behavioral1/memory/1712-124-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CF唯爱稳定透视十字准心稳定版09月22SP2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Loads dropped DLL 1 IoCs

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

pid process

1184 0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1184-55-0x0000000000400000-0x00000000004B4000-memory.dmp	autoit_exe
behavioral1/memory/1184-115-0x0000000000400000-0x00000000004B4000-memory.dmp	autoit_exe
behavioral1/memory/1184-122-0x0000000000400000-0x00000000004B4000-memory.dmp	autoit_exe
behavioral1/memory/1712-124-0x0000000000400000-0x00000000004B4000-memory.dmp	autoit_exe

Drops file in Windows directory 2 IoCs

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

description	ioc	process
File created	C:\Windows\game.ico	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
File opened for modification	C:\Windows\game.ico	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXECF唯爱稳定透视十字准心稳定版09月22SP2.exe0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\Main	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.91duote.info/?w1"	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

Modifies registry class 5 IoCs

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

CF唯爱稳定透视十字准心稳定版09月22SP2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exeCF唯爱稳定透视十字准心稳定版09月22SP2.exe

pid	process
1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CF唯爱稳定透视十字准心稳定版09月22SP2.exe

description	pid	process
Token: 33	1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
Token: SeIncBasePriorityPrivilege	1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

CF唯爱稳定透视十字准心稳定版09月22SP2.exe

pid	process
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe

description	pid	process	target process
PID 1184 wrote to memory of 1948	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1948	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1948	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1948	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1788	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
PID 1184 wrote to memory of 1788	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
PID 1184 wrote to memory of 1788	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
PID 1184 wrote to memory of 1788	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
PID 1184 wrote to memory of 2012	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 2012	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 2012	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 2012	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1628	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1628	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1628	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1628	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 1712	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	Msgbox.exe
PID 1184 wrote to memory of 1712	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	Msgbox.exe
PID 1184 wrote to memory of 1712	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	Msgbox.exe
PID 1184 wrote to memory of 1712	1184	0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe	Msgbox.exe

C:\Users\Admin\AppData\Local\Temp\0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe
"C:\Users\Admin\AppData\Local\Temp\0de4a527e06679ead38bf3250f847729901cab72c9693d7f00e607d04dd6ef71.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.ailili.info/c/c.html?http://go.microsoft.com/fwlink/?LinkId=69157
2⤵
- Modifies Internet Explorer settings
PID:1948

C:\CF唯爱稳定透视十字准心稳定版09月22SP2.exe
C:\CF唯爱稳定透视十字准心稳定版09月22SP2.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.6655.la/url.htm?new_0_http://go.microsoft.com/fwlink/?LinkId=69157_http://www.91duote.info/?w1
2⤵
- Modifies Internet Explorer settings
PID:2012

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.t6t8.com/fuzhu.html?g
2⤵
- Modifies Internet Explorer settings
PID:1628

C:\ProgramData\Msgbox.exe
C:\ProgramData\Msgbox.exe /97sky
2⤵
- Executes dropped EXE
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\CF唯爱稳定透视十字准心稳定版09月22SP2.exe
Filesize
2.3MB

MD5
83f94619c080a23698b38b200ef84c77

SHA1
171a44608b2e8d6b5ca0ed9c94bb73d1fd3932e9

SHA256
e214a8d61d25bcf3973b4e762baa3b7bba8ade5783a88f34845465ad06c5aa4e

SHA512
5e6e1241860d0f763d49ef24b9790cde7c5d2f69df0b32adb3364bc9d1b587266dcd58abeac3e86dc9efe8b62e79928c52982c098c5d600e841e1c876c5934ce

Download Submit
C:\ProgramData\Msgbox.exe
Filesize
273.0MB

MD5
6c0ad6e0854d652f53f36efcaa704c7e

SHA1
ab238df9335398d901d02adc975895659fd8c18a

SHA256
3316744b6fe73e52dd7f332674e5b916ca4570daa636ff63a0e037c1ca9e4961

SHA512
05ff94d1dd986062e8aeeac085c07e7f9ed6562adfdd154665d50906d32f9ef8e36c0f76415661879de3e9a0799d379a9c441e9613d5d56685b966cff453364f

Download Submit
C:\ProgramData\Msgbox.exe
Filesize
269.8MB

MD5
2a50a504bd292b917ae0b2de7bedbea0

SHA1
f7434776f219e968a9d35530b91ef7c32a1a45ae

SHA256
a2795fe880a34c89c9c3262bdcf1ac2a57646579638ac205f913ed3f4d226cb6

SHA512
c0723df55908c0002d4ba4e611b94932eb40df6faae8c6b740480553cc0d3d26ec76c15cfe1389b685f2784ae015d5a356956958f4657fb877b5fccd05f40d41

Download Submit
\ProgramData\Msgbox.exe
Filesize
258.4MB

MD5
4b4bb8008c3bbc44a5c5a928b62a8c10

SHA1
f42060079c01f281688251d1aba30f75e6237284

SHA256
14178c16056342b780fecbcd7c92d276f665b392e2b0c48a61e62be65da61f43

SHA512
d1c4a9303a6a6e9052418c54e94792f339c60c5779c32467a48f47f56ee9de045cc43ffc9fe99c09442e21d2a371ea492149ef2208b7709dfc2ea3045b7d5e84

Download Submit
memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1184-122-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1184-115-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1184-112-0x00000000036E0000-0x000000000399E000-memory.dmp

Filesize
2.7MB

Download
memory/1184-111-0x00000000036E0000-0x000000000399E000-memory.dmp

Filesize
2.7MB

Download
memory/1712-124-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1712-119-0x0000000000000000-mapping.dmp

Download
memory/1788-92-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-110-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-69-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-76-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-74-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-78-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-80-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-82-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-84-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-86-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-90-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-88-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-70-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-96-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-94-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-98-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-100-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-72-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-108-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-106-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-104-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-102-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-68-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-67-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-113-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-114-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-65-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-116-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-117-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1788-64-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-62-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-60-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-61-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-59-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1788-56-0x0000000000000000-mapping.dmp

Download
memory/1788-125-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download

pid	process
1788	CF唯爱稳定透视十字准心稳定版09月22SP2.exe
1712	Msgbox.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads