936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2

Analysis

max time kernel
163s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe
Size

54KB
MD5

3118dc2ccf2c79e35e6077b530045f2a
SHA1

e6e5ab9c8794b297aa8ee926eb00cdbbe8e088a3
SHA256

936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2
SHA512

982571cc8380bef756c51ad42fb547d62e4f1ec3072824b4c6a50b7446472f9a2c2af571d53f6ff20b64f663e2a209e74e454784f5f21ff408617cf029a338e2
SSDEEP

1536:drz9IyO+m2Z18WDMkdk/8M+oEAldgG7NmyzPSeX:xrm2ZKSdK8M+oz/TBX

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4580	inl5D02.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2144	attrib.exe
3540	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	inl5D02.tmp

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3019845381"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu509.site	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3019845381"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000964"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000964"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu509.site\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DF2CBC9C-7577-11ED-B696-FE977829BE37} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000964"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu509.site\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu509.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu509.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3052660723"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4292	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4292	iexplore.exe
4292	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 1884	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	82
PID 3276 wrote to memory of 1884	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	82
PID 3276 wrote to memory of 1884	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	82
PID 1884 wrote to memory of 2288	1884	cmd.exe	84
PID 1884 wrote to memory of 2288	1884	cmd.exe	84
PID 1884 wrote to memory of 2288	1884	cmd.exe	84
PID 2288 wrote to memory of 4292	2288	cmd.exe	86
PID 2288 wrote to memory of 4292	2288	cmd.exe	86
PID 2288 wrote to memory of 3916	2288	cmd.exe	87
PID 2288 wrote to memory of 3916	2288	cmd.exe	87
PID 2288 wrote to memory of 3916	2288	cmd.exe	87
PID 2288 wrote to memory of 4048	2288	cmd.exe	88
PID 2288 wrote to memory of 4048	2288	cmd.exe	88
PID 2288 wrote to memory of 4048	2288	cmd.exe	88
PID 4048 wrote to memory of 4816	4048	cmd.exe	90
PID 4048 wrote to memory of 4816	4048	cmd.exe	90
PID 4048 wrote to memory of 4816	4048	cmd.exe	90
PID 4048 wrote to memory of 3472	4048	cmd.exe	91
PID 4048 wrote to memory of 3472	4048	cmd.exe	91
PID 4048 wrote to memory of 3472	4048	cmd.exe	91
PID 4048 wrote to memory of 4800	4048	cmd.exe	92
PID 4048 wrote to memory of 4800	4048	cmd.exe	92
PID 4048 wrote to memory of 4800	4048	cmd.exe	92
PID 4292 wrote to memory of 2824	4292	iexplore.exe	93
PID 4292 wrote to memory of 2824	4292	iexplore.exe	93
PID 4292 wrote to memory of 2824	4292	iexplore.exe	93
PID 4048 wrote to memory of 3348	4048	cmd.exe	94
PID 4048 wrote to memory of 3348	4048	cmd.exe	94
PID 4048 wrote to memory of 3348	4048	cmd.exe	94
PID 3276 wrote to memory of 4580	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	95
PID 3276 wrote to memory of 4580	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	95
PID 3276 wrote to memory of 4580	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	95
PID 4048 wrote to memory of 3784	4048	cmd.exe	96
PID 4048 wrote to memory of 3784	4048	cmd.exe	96
PID 4048 wrote to memory of 3784	4048	cmd.exe	96
PID 3276 wrote to memory of 4904	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	97
PID 3276 wrote to memory of 4904	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	97
PID 3276 wrote to memory of 4904	3276	936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe	97
PID 4048 wrote to memory of 2144	4048	cmd.exe	98
PID 4048 wrote to memory of 2144	4048	cmd.exe	98
PID 4048 wrote to memory of 2144	4048	cmd.exe	98
PID 4048 wrote to memory of 3540	4048	cmd.exe	100
PID 4048 wrote to memory of 3540	4048	cmd.exe	100
PID 4048 wrote to memory of 3540	4048	cmd.exe	100
PID 4048 wrote to memory of 3372	4048	cmd.exe	102
PID 4048 wrote to memory of 3372	4048	cmd.exe	102
PID 4048 wrote to memory of 3372	4048	cmd.exe	102
PID 4048 wrote to memory of 884	4048	cmd.exe	101
PID 4048 wrote to memory of 884	4048	cmd.exe	101
PID 4048 wrote to memory of 884	4048	cmd.exe	101
PID 3372 wrote to memory of 916	3372	rundll32.exe	103
PID 3372 wrote to memory of 916	3372	rundll32.exe	103
PID 3372 wrote to memory of 916	3372	rundll32.exe	103
PID 916 wrote to memory of 4920	916	runonce.exe	104
PID 916 wrote to memory of 4920	916	runonce.exe	104
PID 916 wrote to memory of 4920	916	runonce.exe	104

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2144	attrib.exe
3540	attrib.exe

C:\Users\Admin\AppData\Local\Temp\936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe
"C:\Users\Admin\AppData\Local\Temp\936da9440a5c092acdead3b3992e96526cd47d811606f644b57d801cf45e1ca2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x5_20_ml.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2824
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      PID:3916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4816
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3472
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f
        5⤵
        
        PID:4800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:3348
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:3784
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2144
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3540
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:884
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3372
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:4920
- C:\Users\Admin\AppData\Local\Temp\inl5D02.tmp
  C:\Users\Admin\AppData\Local\Temp\inl5D02.tmp
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\936DA9~1.EXE > nul
  2⤵
  PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f8f8086f87156d14091b152fcaadc3ce

SHA1
fe3cfbf9e2e871c948300473593dfcf189013386

SHA256
8d92f28b70ed5265fafad8b37ce049b0b8ecad038745173acc35a21b8222bf56

SHA512
1235be77513694a1478459e999631920be42183a6993dc1f93333831eaa54ea60c7d8617029289c95fed2f861fc7aa79da551c128df4428d23752044eb68ba7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
4d23a77be9e75df6860439165a17612c

SHA1
a5f76e09f49d662dfe4f1348d46ce462129f4061

SHA256
c5d7fa27966ddbbcca049e73b8234ff077ed5a7a6690c14fe0a85cf09bc60aba

SHA512
c165c67738698078ad4aff2a069e2bbceb64f675d3d499e47be60f04900d4d0a47b1e9703df595096383fb6e744172d7de284cd33481180098693cd653801e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
639B

MD5
6fd9d8e6f820fd6778fb7dad894ce95c

SHA1
2cf91a7b933f56e890c7d11082cf2c1a473e0109

SHA256
41ea0ff989f30f6e4c9e6847499cb93ac15b6084b30f6d956f2c281283910bf9

SHA512
a6b024021c199f318a78a8107ff443f5017d0b7beb61d86946eb5fb64758f65e85b2364d1e4e910c01fcf2acc5517d20eccac8154f696c3c5e6395d32e78f3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl5D02.tmp

Filesize
57.2MB

MD5
1d6d4a48d1224f2faee4de4df623ff5e

SHA1
470fb458b062922a1a0b9b89156f2e192292c018

SHA256
0b683160760e5dc8d963f8e9ffd9f672ad390c9029028036ab398cec799bac23

SHA512
61cb1119828b7c3aeded456cab857acadd218799a42ddcda9ff54034bf254221b5e71adf5904921da9e0a52315393ded962c36de3782097da2bda3d3a5c7f725

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl5D02.tmp

Filesize
57.2MB

MD5
1d6d4a48d1224f2faee4de4df623ff5e

SHA1
470fb458b062922a1a0b9b89156f2e192292c018

SHA256
0b683160760e5dc8d963f8e9ffd9f672ad390c9029028036ab398cec799bac23

SHA512
61cb1119828b7c3aeded456cab857acadd218799a42ddcda9ff54034bf254221b5e71adf5904921da9e0a52315393ded962c36de3782097da2bda3d3a5c7f725

Download Submit
C:\Users\Admin\AppData\Local\Temp\x5_20_ml.bat

Filesize
53B

MD5
23962a245f75fe25510051582203aff1

SHA1
20832a3a1179bb2730194d2f7738d41d5d669a43

SHA256
1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

SHA512
dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.bat

Filesize
3KB

MD5
60b83f28f7a84b223dc19ffdfff482fc

SHA1
f33a5aed6ba5fc5b07df49da757cc089ee0152ac

SHA256
4f7d844924c5fb8be4b9f12f602597a54273c8abe9baa715fd0148b3404a3eb4

SHA512
54cc35b7550f7082160344b7cb5b2772bbd9c89093c78bd5044a838ac9c91585d85d87c0f1229e4ff0d5d2f27377edac13c538b17197a8f266e678adb03ee4e8

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.bat

Filesize
3KB

MD5
d4917ae9072a10d8e12ef3b282b25b3b

SHA1
bd9ec6c6395997525ec7c15ecca2f115573cc14c

SHA256
6f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b

SHA512
c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.inf

Filesize
247B

MD5
ca436f6f187bc049f9271ecdcbf348fa

SHA1
bf8a548071cfc150f7affb802538edf03d281106

SHA256
6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

SHA512
d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\4.bat

Filesize
5.8MB

MD5
e3a117f066e3e2bf471580b3ba5d2964

SHA1
fc7d7451602d8039f1ae372dd331dad50f46b68f

SHA256
2d0de4259e11514160ebf94ce1f71e065cbfc70ec4c982ffa13b4e86f9ad8c45

SHA512
9bdcee8d5c521121a963b6454328598fb4aa69529fca0adc300bbc32f2614a9cd2c675b9e352d852ddb849826d1e7ac958c8a80950810c510f1e968d96e819fb

Download Submit
memory/3276-132-0x0000000000C40000-0x0000000000C65000-memory.dmp

Filesize
148KB

Download
memory/3276-194-0x0000000000C40000-0x0000000000C65000-memory.dmp

Filesize
148KB

Download
memory/3276-134-0x0000000000C40000-0x0000000000C65000-memory.dmp

Filesize
148KB

Download
memory/3276-133-0x00000000008E0000-0x00000000008E3000-memory.dmp

Filesize
12KB

Download
memory/4292-152-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-148-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-166-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-167-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-169-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-163-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-140-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-162-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-224-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-177-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-160-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-181-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-159-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-157-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-182-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-155-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-183-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-184-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-185-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-186-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-187-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-154-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-223-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-151-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-164-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-195-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-196-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-147-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-198-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-146-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-144-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-143-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-141-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-201-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-204-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-209-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-210-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-212-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-213-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-211-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-218-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-215-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download
memory/4292-217-0x00007FFA689C0000-0x00007FFA68A2E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads