Analysis
-
max time kernel
95s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe
-
Size
45KB
-
MD5
04aa066648723fa29f91be2c161d48d7
-
SHA1
d10c90ae06d33e82eb700b0315cfa2d29f06b724
-
SHA256
c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d
-
SHA512
54b39bb38499939354cacd8d8f4c7980b1c3016b168bf0df68c704444b86d8b6734b4b6fd766a58b48e9103566db6929bb277e9219e149ed614b74d6b48ebc6d
-
SSDEEP
768:SayXjOAnVZuWtJbIY+pmQRGJCu5tJxBf7naZrYKcF70FtAH73/aZuCmrIUE:SZFkW/ymMEXrJxxcrYKcF70DAb3/2uCP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.03667.com/?s" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.03667.com/?s" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe -
Modifies registry class 53 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.03667.com/?s" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "202251" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688} c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command\ = "iexplore.exe http://api.11zuiduan.com/taobao/t2.htm" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ = "ÌÔ±¦-¹ºÎï" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\dao.ico" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\WantsParseDisplayName c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideOnDesktopPerUser c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideFolderVerbs c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\Attributes = "0" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221207" c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2284 wrote to memory of 380 2284 c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe 79 PID 2284 wrote to memory of 380 2284 c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe 79 PID 2284 wrote to memory of 380 2284 c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe"C:\Users\Admin\AppData\Local\Temp\c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exeC:\Users\Admin\AppData\Local\Temp\c53bb889d617a82c3f4a17c9d7252aa387c886823b70d73c537a6192d5b8294d.exe2⤵
- Modifies Internet Explorer settings
PID:380
-