edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1

Analysis

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:57 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
Size

1.4MB
MD5

fe61b30a71369fae49939b595631ff47
SHA1

c6c23ffafa68c73e28dc3cde9f7033f15095489b
SHA256

edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1
SHA512

1c1995b6b36562cc1d1513d8b4cd791ce9a19803633a210171770dbd2056726d7628fdf79cc314f9abfeb9d101875c5ed28ee6144d3f2da8d6863e558928843c
SSDEEP

24576:Hq+0QyI6VmrEGNLVV4mpeCNRcg7KD5120nfhiadM2Ob0JC9c+e4JsVBw2qbyuzN:jryI8GNxL1J7i20nfhiJ2Ool+e9ViFdN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000822aaf6ce296234ba18d9e8deddae505000000000200000000001066000000010000200000004ac84894fcf9a29f684c0eebef3e52d349b41675c59b532160d2c018521cffbe000000000e8000000002000020000000d0fc1fdb6ead147aaa694a5d1f0222334a61374cd8df8fee8e353c5e8a520ac090000000c20b6c47218a1077ddb327374486f4a81fdac0838f376567cbab2a803674d278abfaec971a0101394b0c28e0071ed4edee33258ba6ccfed39f385f990fcf34149fe0dc71980e7f7a55e6b076aeb7c2e7f153cc85f93acb88c6f08501dc97015541ba7eb2371b85ecb8339f7483742f512926f10e7baf3c0c9569949633b8935f28f80bb65be05b441fe37b4b2a04a49d40000000ebb7cbb2b2e1ac45b95841e8379eece26b239a3d18d61dae4ff29a125e357207c0ed26f8cfd138b76915c0f8a29d7cfa7808056a83da0916aca65f0784ce672c	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{104101D1-78DE-11ED-8B83-6A6CB2F85B9F} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377478050"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000822aaf6ce296234ba18d9e8deddae50500000000020000000000106600000001000020000000026ed9ab94479bfa06084b231f8ce4b272f302fce312e739d7316cc091c95180000000000e8000000002000020000000d71f42ed733b6c2fba7442e8b69ae8a074019ac08975007cbe38451c98a0ed72200000002c5b18327f0ff9902a582ba362297dca552d6add8ab7a47876f73dc5a1bb2bf14000000084225d7128bdd4dda6e1e36a17684fc9958efaad5890796da566c18d4005d03d2c969ac0682614fde3fc694e943e0db7524564f7f21dee81986f7815c7f80ec5	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0131111eb0cd901	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1612	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1952	1612	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	26
PID 1612 wrote to memory of 1952	1612	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	26
PID 1612 wrote to memory of 1952	1612	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	26
PID 1612 wrote to memory of 1952	1612	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	26
PID 1952 wrote to memory of 828	1952	IEXPLORE.EXE	28
PID 1952 wrote to memory of 828	1952	IEXPLORE.EXE	28
PID 1952 wrote to memory of 828	1952	IEXPLORE.EXE	28
PID 1952 wrote to memory of 828	1952	IEXPLORE.EXE	28

C:\Users\Admin\AppData\Local\Temp\edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
"C:\Users\Admin\AppData\Local\Temp\edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.a585.com/?down
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:828

Network

DNS

www.a585.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.a585.com

IN A

Response

www.a585.com

IN CNAME

hg033tiaozhuan.as40065cnservers.com

hg033tiaozhuan.as40065cnservers.com

IN CNAME

hg033com.as40065cnservers.com

hg033com.as40065cnservers.com

IN CNAME

y4p37mbk-u.as40065cnservers.com

y4p37mbk-u.as40065cnservers.com

IN CNAME

6az7fc4s.n.as40065cnservers.com

6az7fc4s.n.as40065cnservers.com

IN A

103.117.100.129

103.117.100.129:80

www.a585.com

IEXPLORE.EXE

152 B
3
103.117.100.129:80

www.a585.com

IEXPLORE.EXE

152 B
3
103.117.100.129:80

www.a585.com

IEXPLORE.EXE

152 B
3
103.117.100.129:80

www.a585.com

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

IEXPLORE.EXE

152 B
3

8.8.8.8:53

www.a585.com

dns

IEXPLORE.EXE

58 B
193 B
1
1

DNS Request

www.a585.com

DNS Response

103.117.100.129

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DHBDWPTK.txt

Filesize
605B

MD5
a86e38b509dfdd70545fa8c1d4419911

SHA1
3904665d7de175c2a8d6acd3bb2ff9b548aae73d

SHA256
ea59346f144768fc1e7c2524315d14a6f943b900a1c94bbd603fd0b0a01f868e

SHA512
7425db7a5990828aebdb286ebc95fca1c6b68f59d1f737c3f337993c0011db39a54aafe659aa9eb870b95ad7dc886de1eaeb506aecf64b37a03f9c48f76a0c71

Download Submit
memory/1612-55-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1612-57-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download