d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19

Analysis

max time kernel
182s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
Size

718KB
MD5

56ea21d593c57095797ac79dc03bd4a7
SHA1

76d220d9af6e161b5642456ae9806c9e6007b665
SHA256

d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19
SHA512

b419e3842b83564a1551b342712bb5f6006d3ad9a056adf4a6da6c9c4a28d57380fc0655ac43ab5ce2a18cdeb837108685c0b2da961a9399179be52ee90c3903
SSDEEP

12288:4eKrJJuf86AYcwo8oSAcNEMZMAFOVhEce7Zaxb7eInfX6Kt6supy3HZUvz30:4ruf/AfwKcLLFRHZaxb7eoKqZUvr0

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Program Files (x86)\\Winrar\\Monitor.jse\" \"%1\" %*"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DROPHANDLER	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\ = "´ò¿ª(&O)"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\SysWOW64\\WScript.exe\" \"C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\cgi-bin.jse\" \"%1\" %*"	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe

Executes dropped EXE 1 IoCs

pid	Process
316	baidu.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-58-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral1/memory/1992-68-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
292	cmd.exe

Loads dropped DLL 4 IoCs

pid	Process
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
316	baidu.exe
316	baidu.exe
316	baidu.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1992-58-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral1/memory/1992-68-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x000700000001347b-59.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-59.dat	nsis_installer_2
behavioral1/files/0x000700000001347b-61.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-61.dat	nsis_installer_2
behavioral1/files/0x000700000001347b-63.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-63.dat	nsis_installer_2
behavioral1/files/0x000700000001347b-64.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-64.dat	nsis_installer_2
behavioral1/files/0x000700000001347b-66.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-66.dat	nsis_installer_2
behavioral1/files/0x000700000001347b-65.dat	nsis_installer_1
behavioral1/files/0x000700000001347b-65.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\go2000.com\Total = "900"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377248059"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.go2000.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.go2000.com\ = "900"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\go2000.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "900"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000009cc3e58e51023a9e4c6a2263ce7d44ad8e39116f9d8a59c257906e8c6a1c8ee7000000000e8000000002000020000000bd20d9ec839292051ee51785b7741645951a43e0f0e7164bc5ce726925a7a46f20000000ba1fbc0bb72db5fedb6d2a870eecaf486e9c1cc35eab86c7016aea1a23567c0f400000009643e0d9bd63bfdc013971e169e0b0e7dff29c820c109b73a1155078b87ff76b43d2b3a267c2f92a6687e0af0621414441eb36e84149f1a9f0b5ca38bcbb7997	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95096341-76C6-11ED-8CB6-56A236AC5043} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\go2000.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80600994d30ad901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000013f37dff256b0f7cb29936f88eb886df8c1e6327cf40e822cbd4bedc8882ca8e000000000e80000000020000200000003c1ca95367f58b2ff7b778eaf936e7e5774204af58e12df604dcc25d561902a590000000c4e9efff8c99222f61e434c471214391b7c09c3bb0674940512b9620a85d7749616171ded1481561de8bc4222c221800b9d38663c89e9f70e82d990899040fd3f535789c1a213f82ada5a3e84dcf3bed8bd2dd9664f13e0fbd0e8bbb4e13ffb0ad971223f54e236b058724af675a73b5bcf8e30b672dfde9da4751bc2f6571a92c52ebca7d632b8759366d9fb511451f4000000019897a748359852d5951677400b43403bc53e14ea2aa51b3690fa89f4c3c40ed82ef15b992f08c8afd7bac81f4d0e76d578e91f78b1c26f28a9ba7dd9b01c85e	iexplore.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\ = "´ò¿ª(&O)"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Program Files (x86)\\Winrar\\Monitor.jse\" \"%1\" %*"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\SysWOW64\\WScript.exe\" \"C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\cgi-bin.jse\" \"%1\" %*"	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214EE-0000-0000-C000-000000000046}	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx	WScript.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DROPHANDLER	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1360	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1536	iexplore.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1536	iexplore.exe
1536	iexplore.exe
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1152	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	28
PID 1992 wrote to memory of 1152	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	28
PID 1992 wrote to memory of 1152	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	28
PID 1992 wrote to memory of 1152	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	28
PID 1152 wrote to memory of 1536	1152	WScript.exe	31
PID 1152 wrote to memory of 1536	1152	WScript.exe	31
PID 1152 wrote to memory of 1536	1152	WScript.exe	31
PID 1152 wrote to memory of 1536	1152	WScript.exe	31
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 316	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	32
PID 1992 wrote to memory of 292	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	33
PID 1992 wrote to memory of 292	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	33
PID 1992 wrote to memory of 292	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	33
PID 1992 wrote to memory of 292	1992	d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe	33
PID 292 wrote to memory of 1360	292	cmd.exe	36
PID 292 wrote to memory of 1360	292	cmd.exe	36
PID 292 wrote to memory of 1360	292	cmd.exe	36
PID 292 wrote to memory of 1360	292	cmd.exe	36
PID 1536 wrote to memory of 1788	1536	iexplore.exe	37
PID 1536 wrote to memory of 1788	1536	iexplore.exe	37
PID 1536 wrote to memory of 1788	1536	iexplore.exe	37
PID 1536 wrote to memory of 1788	1536	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe
"C:\Users\Admin\AppData\Local\Temp\d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\monitor.jse"
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g9
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1788
- C:\Users\Admin\AppData\Local\Temp\baidu.exe
  C:\Users\Admin\AppData\Local\Temp\baidu.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\d78bb6b2684b841cbcffba8fc8e5448b112faeb617393d0cd2117cf94a2d7b19.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:292
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.1
    3⤵
    - Runs ping.exe
    PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95580f0b53e9e83abdb552d66c8c829e

SHA1
5f359522b7a02dc5a01c570056e22fde143ddc83

SHA256
a890214c71c05fd9db5509f47b8f86b62a200a578904ecc78f6b521d57f52998

SHA512
dca353fb865344570395e1d8d6d795976dc8e05b5a8ea275a4f7675b98de414e6a51d4634230a732dff603e405a91039695978b8eed766f3b4b1d4c6935ba0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c242d1eac7d356fd236242dc1d9ada5

SHA1
b77dc838f3c5ba1f4a47e71fd5a7a4221b99c316

SHA256
ec2871ccb17864d6c980abdd123a71ac1bf77c7616ab301e468313d503222690

SHA512
05a4707238f677cb1079d31c7c59b48b6e7bdbc634d2cdf1df394bad9e22af308e5955b9697fb46534b4060699b996fa307bef2e1afd401bb0bd3e9b3792c4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8922e63ec6e982aa6c8bdb829de24b0

SHA1
fc7416a3c2cdf3d0b185007afc6f7f65fc3cfa06

SHA256
56087479eded3fd2b7eab15fc4e7213b8053be61c4855c34ce6dc8a290a2666f

SHA512
569e6573570a25f0febfd17bad1d99a13cf268992d4bdfe9b8c63edb2dbb0ed57bd8d031fb38920f48058dd26f52173b6227b60f93bff3ef4cef50434f86be1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c34daa60d9aeda1516ec9c606b2342d

SHA1
d9dfd94787aa5aef4d1d8ee82583c31bded52ea4

SHA256
432e379bb7484c078152f81d10dc62b5ba564f35214fce435d4665ee6182fdae

SHA512
6de2b7bbe15956b6ed036af1068cba90a3338ae54afabb6099e7fdcfa1902ad29b473b6f5adc0ce30c9e32ffe4ff50abf7eb81fe0348d36cbe672a17118b8a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1de7592653c7c97ff525440d7c537260

SHA1
3c4758605dd60f58130d84c696aa1267bb83cc52

SHA256
47b77b8dee83d38323d33e47ad7481267a61ca3c78a92c7f6b354d5d1074725b

SHA512
ef5b5c973efea1087d971b081b7627f0556f711f689b013597ee69e7502e4b8aec34d5c749171ba264d583b50ab3d534ee912a7f5d411a5f69726e9cfcbee58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d92b7a3b9f06cdca958e732562965c

SHA1
06fc5660584f70809e4688482608c74344cf347c

SHA256
df4158e467227145b42802c901af3e9f5aa573b784729447310ed67e42cb3c8a

SHA512
9634970e7aea5cccf1b01c0ae33f8bf662230ca70954a04b87d015930f5a50f2b5adc4db4eacba8d86c0a97085008babd97483f2c9c6cd807da3a7ca83b67f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dc849c92f1e41697d25fc10fc426b23

SHA1
44befa9ad4e0490feca2c0c7bc2c353db0bae789

SHA256
7ffae4074412a78dbaf4732694982eae718c51c2095d5bfbde5f259dbba50138

SHA512
90b11b8baccd048f135678d2e4a2b85f87ae70955c5a3326db056422571a0cb9e04df673e355a08ac32cc4b2f42291b6e82a515130b1e0f194540778491f6162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d912db21eaa5dc1891008c0558be3ab3

SHA1
57c42bb9987ea2390e91cb6af4057ffcf365e853

SHA256
93ac9a141a4d894b48cebfe8a648df0d92193a981c42b0b6410ac29d000c50ca

SHA512
588fdbabc00a1c3e8a9f4b0e2b5515746ecf40dc33979419e17b1bc07d10eff8abfa486460b488ab415b777f3b83ae5c01672f7b7bdc3fc4cc79b89086533e1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09dae38b590f6da1585511a65440f0f6

SHA1
12ac474762c7d845b3559341f946962b10eb4276

SHA256
086a1e1483915c26dcd28617e9cd90345efe97ab434835f6d8a95a4676f203b2

SHA512
52c5b770fff04024e9f34decd0d8a988f526ef4e2a39fa590ca88ff9dba80f056f40b76020e06d922be9aa0091908fdeda48cc55af3d1fba71f09db03889eb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dd184384c5ad0bc39e5ccdb1c19fe58

SHA1
246dddaab17d521ed1e278d05424b4fa445bc13e

SHA256
e5d397895348d8f225625084c875a2bd10b1606e587e57c894e4c89f07eb6b67

SHA512
f4eb851af99c11184f254b58c389e200a853e50c50fddb0752f14d19f832562e38e6db0fd321003822f8364700983bdfe3b0426fee3804816bdfb8ec164d6473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2b1ba53c3108be2d156aa993504dc8a

SHA1
03ca30de5fa63e7dc8469fbc5c7c5d2376794ef1

SHA256
5c2ccfcff8b5feb0dbcb6d76598b3a41a4bf57da55aa02579f507ebac6d080c5

SHA512
ed13103cd515cca9d7274b45939a67809a68c29753cedbabf1c655d45ae9b917552e3af1e20f42198c2c726d9a5c29645d35f77f0c7e0af858e3858983bec96d

Download Submit
C:\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
C:\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
C:\Users\Admin\AppData\Local\Temp\monitor.jse

Filesize
7KB

MD5
1c31e476241294110eeedeeee5518185

SHA1
d6d16ff5949111243addd0bfd6f1c72ab3b742af

SHA256
5bf284c882b106d714b5a9cb353a80a9fdd0cb5bf9e8ebb6e2fb444617d86bca

SHA512
a135c9b2a700df76412a9a485f3364f00fd04966c3831aa0b78d19e15506caad0600fd1ac695fc49e700350a2aeb43dc0fbf5929738d1e9baf6630e052f39b90

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HSU7ARQJ.txt

Filesize
608B

MD5
9cc6d6826a39003bc0a196c395abec7d

SHA1
c27ae8b4d4df7d921a61cdde521a4c48250806b9

SHA256
c54d6347b22432988690244ca450793c87fcbd8dbeda1a1552036958cd954838

SHA512
3a223191fe01ed2042e9ed9f89026822e2e3734069b7c4e0aa377a0a845275bece9693ca2abc25a20dafd6ab69593a46eb7f78eb54edde7c896acc1508be4dd2

Download Submit
\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
\Users\Admin\AppData\Local\Temp\baidu.exe

Filesize
456KB

MD5
b7456a4b1831ea2828d3094ec59b7070

SHA1
f6330c503f668a4e6b3ac3408e5a62841159bd1d

SHA256
67cc2405420fa1f04e3ac88228708d903390d14fed2481894e133cd9caca17d0

SHA512
4c103cccb44841403416bf450eb05d7909e770f7f5ece36a44aa9af9184b0b839cf2920ec9a647e83b076a4f7a7af0c0611c14319c7f8729a9d3e2ef6db8c993

Download Submit
memory/292-67-0x0000000000000000-mapping.dmp

Download
memory/316-60-0x0000000000000000-mapping.dmp

Download
memory/1152-55-0x0000000000000000-mapping.dmp

Download
memory/1360-69-0x0000000000000000-mapping.dmp

Download
memory/1992-68-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1992-54-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/1992-58-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download