Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 13:18

General

  • Target

    9e4030f82b402264b078e986f45b65e3.exe

  • Size

    1.0MB

  • MD5

    9e4030f82b402264b078e986f45b65e3

  • SHA1

    dcfde41986aeacee1036208710fbcbb4634d7d55

  • SHA256

    9e3f05de9a92d7b8389a85aa2a088685b6c1a12196af4cf6b3a52f9c7533c6e9

  • SHA512

    18ce585fad569fa72cf8d13d40e75f5b6eb4beed78dde2e14755cd7f7c8dd2381051d318165302c877cf532d3170834d3e2b9d58406db348873ee637645c358e

  • SSDEEP

    24576:UD3euKmLCkWZmmcHTrlQzSraIKu78ThO3pEUaUTV4s:K3+pFoHXLaI8KaUT

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e4030f82b402264b078e986f45b65e3.exe
    "C:\Users\Admin\AppData\Local\Temp\9e4030f82b402264b078e986f45b65e3.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.2127.cn/?newth3
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\TheWorld3\2\【凡客诚品】.url

    Filesize

    171B

    MD5

    29c9210ce2020e78e29e5290997e1681

    SHA1

    cd09c61b144274c003d1e8afe80b104d1d262eac

    SHA256

    f0efc91674fb5a9c053eaa4f4340c06a7334f4472fac55a41a99367f2772c80c

    SHA512

    73d77ccce356080d96ed200e2cfbb180981bcf5e0dd7cacc6daafab1cecc1806e223b539983ffb19707fd2a7b9bc53b650c533a94346261c6b7d021594282701

  • C:\Program Files (x86)\TheWorld3\2\【台湾美食】.url

    Filesize

    134B

    MD5

    25852a9ccf176fc455d9752841d27114

    SHA1

    d7f298bd5fd616e0ec0778a69024d21653c83ef4

    SHA256

    22dd6f2b0ae0e373796457a5414a3535367a358f531d07bfd220f1f36213da02

    SHA512

    eec5fb3f9fb14e6bcd27b42165842a250eb0338085c054bdb00162a0e11663972764e07e8449a288a9b641dd5f3d2d11216f788b4f5676f179748dc1e4a24683

  • C:\Program Files (x86)\TheWorld3\2\【当当商城】.url

    Filesize

    148B

    MD5

    534258e4e339fee83aa9ef5b005230db

    SHA1

    2cc1b6041cdfc966b491acbe106873f5685a52e4

    SHA256

    004f141cebf461546da744adf398775bc3005ffcf7ace4c8c28a9b9c104f02ec

    SHA512

    ad5d2787420bbcf412885d43dbf973bb72fadc9551a71a8d7eb05646e7eaf43ddb243dde45938bf07dfee637dc5ebc330968f7d588c92d95f86ec0d4dd6f1f0e

  • C:\Program Files (x86)\TheWorld3\2\【淘宝特卖】.url

    Filesize

    192B

    MD5

    531afa31e63f4340844de937716019eb

    SHA1

    7505578b1384caea8bd7cca0e0e4814c65b98453

    SHA256

    6361d0896bee3569562d2add5b93c8e1cd6250acec04206e219abe598c78326b

    SHA512

    b272598cfa49b8d4c7ce6fd32a14a64d6e1554ff1654f629d35311bf40377065d578c12745052ae9a889e5d7f798a73413273b027ab43140041c1ebdd0afa2a0

  • C:\Program Files (x86)\TheWorld3\2\【淘宝风云榜】.url

    Filesize

    142B

    MD5

    c931fadca55f88e0e5edb7552c4b1ad9

    SHA1

    aeec96c72c7db3ae94d25369e8ff73745af6cfb4

    SHA256

    93e8c38c6d5286c7922be4944a87787aedca8d5c9478e4f89c4fe1de7371b710

    SHA512

    a5c95e5a1236a9eb3bed1ba8cfd99c48516ad30ed28bcb1453928731c3e4ceb68cca61a4d1122a5c20717a539e3ff98fe86cd555216e4bf368e537b2927296a3

  • C:\Program Files (x86)\TheWorld3\2\【疯狂购物】.url

    Filesize

    82B

    MD5

    d8b0997d51b69f071b951de35a1f5f4e

    SHA1

    c0f634151c7c70c0d661d6e36e3298571854239a

    SHA256

    69bf159c06d52670174336c3a229afd1e3342fd3a25666fdd4617fe211945fc3

    SHA512

    d03b46f108e0da4bc800163fd60108d1f96cec69119b623e29c83a97d33bad28b7428f47a05cc65b8058cedf536fe1c35d9db6c1c6125abcca4d9d9d724ccbcf

  • C:\Program Files (x86)\TheWorld3\2\【网址导航】.url

    Filesize

    78B

    MD5

    15a0dfd6971a548e27da0e9e081fb20c

    SHA1

    d4e96db0a1f75cb170db214d2a3bc837d8cec84c

    SHA256

    0301c5ca25bf7462637537ec02af8d5e59d573ebdf783568b24cd7048e283589

    SHA512

    779392917f82d8517ea4cc0c48ffac06e20a1cdf6950ec170600cc789305eb9669559c67a097150f40d2fa676e41308abaf07a5e58f1994ccf6988477f4214b6

  • C:\Program Files (x86)\TheWorld3\2\【美容秘籍】.url

    Filesize

    134B

    MD5

    57efae2fa1413b359aa55ebf818d44e9

    SHA1

    a25ed510c0de2b7d714c20fdac23db9c1c5f4128

    SHA256

    bbcbdf46a55af3d1511f0b2d52939213810d2b9c0c54d073c8d09429961b88b2

    SHA512

    3a3a4074db5d4a3af95cadc3da8751012993d6c011de49f628dbe45a13d3cb8dae8278813eaed57b8e071df97560d05270ea3116b28e6d0de6a4d75fdd9ebc9d

  • C:\Program Files (x86)\TheWorld3\2\在线网游.url

    Filesize

    190B

    MD5

    f48866be4b9729453057af8c2de8cb84

    SHA1

    f48cb381e5baaf598da3f464836ab7ef628b0710

    SHA256

    b0cab2c945158a89985a9d5b77704fda9a7495858ca5c7ebaad5b524f303861b

    SHA512

    a1a4caa9fcfe83f9eedfa7e435229e32c5d3574798b59700591e756a5aa2eaf2f67943b467e47088c685d078dba6eda30e7ac292068557fdb7f5316ff47625ea

  • C:\Program Files (x86)\TheWorld3\2\实用查询.url

    Filesize

    78B

    MD5

    05f923433437db81afa7a2b19d3c6f51

    SHA1

    19b6b8a548c430b1fca8a214874d67c3915bef85

    SHA256

    ce2c4d2b876cdf11b707f79b45b891f674025f421b6e8c99c40509e849c67e68

    SHA512

    dc431b7ab359ee1d1147c2272461b0dc0b8f41bda55d8ec4f4e3d896013121bd88c32898a844494bdde8a37ce7823b49dfed3a31625d8b006d16e961d462ed17

  • C:\Program Files (x86)\TheWorld3\2\家电商城.url

    Filesize

    126B

    MD5

    f847c2a7d92d221480d4577b5f4a02f1

    SHA1

    287d2ed6b93141516651fd902394afe0ccfe8c5b

    SHA256

    4d097096fdbba3ed61c35598bb26cb66e407dad48bdd9cc6f630f272bf0b318f

    SHA512

    191515b24148a710f7d2ab6187005be0a09ae9bce72507d963411234b36458b5de9dd935818460a6af4d121c48aba7dc082bca23a06844948d3143ef0b858e9d

  • C:\Program Files (x86)\TheWorld3\2\淘宝网.url

    Filesize

    145B

    MD5

    73e9d1a5c85a6d17cf6daf1a29747d68

    SHA1

    80586a1a5420d56f65e37d0b1b0b7c2faf19a79a

    SHA256

    9f4bcaef43c584c99aa48042285b3f744ee9eb1afb934bf2864759543819fae9

    SHA512

    0a68b2230fccb66814b5d85fa79beec4b633361e1273499417cdd9676320398c6056d2b95500e1191b467bd2f5a462f1cc0bc76ccb4e11120fe0cb375d3040ca

  • C:\Program Files (x86)\TheWorld3\2\游戏下载.url

    Filesize

    81B

    MD5

    cf8565c8ae2227e2405d6dfacaa04879

    SHA1

    471aeda36ba5044533b24886189e68e43538f01d

    SHA256

    4a1dd24faf80eda60d1f60e2c84a727e20be9b4aa6b032d61560ffcde73e9b44

    SHA512

    654fb592ddcd92b1979fe89edbfa6c228a757d52acc0afb49d4e2177bd0c3697a67eccf1da112340d02f240ead4554b01cd8a2ce13173d0aeef14f2526c4fe53

  • C:\Program Files (x86)\TheWorld3\2\电视直播.url

    Filesize

    184B

    MD5

    de76ed786e20dc35d1462da506355f6e

    SHA1

    f302c494fe862e046c39482ed5e698450c1771a5

    SHA256

    0fd9332ea18b83e7f313cc3960010b10fa4f1d1590f8f5ef75254d8ce121c9ab

    SHA512

    9261c8983f319210df9eb5c7439d79547f47f74218683d3d43b8a8a660925bf5a9b4415cb15011d7dd6732f56ee20596b465faea23a4cdc7e873b656bbb0a65e

  • C:\Program Files (x86)\TheWorld3\2\百度.url

    Filesize

    141B

    MD5

    78412d08796c909a0853a1dd18ccd586

    SHA1

    ceb2d947d41df77377aae60ab559a304fb405b59

    SHA256

    7e03a4aba9fe8f15abede66b5ea190ef7d1c16e200b342a7b9dfd417545150f2

    SHA512

    3beca38f6f757b3df3d7cf836ffc996e8a713df809fc5cad3f81363991943123acf55656c767b898b025760d0f113d53a1211c231332569f2027bf4f4b59e119

  • C:\Program Files (x86)\TheWorld3\2\系统下载.url

    Filesize

    183B

    MD5

    e321c8319ae133844943486b541461dd

    SHA1

    8e18a6bdb999a036cd407521e64ada293c0e61b6

    SHA256

    8d1dc50916793e02d99602dbbbcba6fe43346521ec8df4cb83a2399f0f7c684e

    SHA512

    cd0fd9fd5082c20045a43b8904d3c4a196cdd5f977bca7c6eb71f4968bf0d9b91eb78dc7aabd4162f28706312da78ba435e01d4412ca02fe3a83decf373a3b6e

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF339.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV2I56HE\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\aut7880.tmp

    Filesize

    194B

    MD5

    9018fcca1506b6e9998cf9483068765d

    SHA1

    ca7297f37507501b783b9384597b95f7a77e2602

    SHA256

    6589fb51a3d3c0128ba11a27383ef8f4f4a76d87e343a022555e1b8c63b76de4

    SHA512

    0811dd3febb468711702e15a32ced2f1bc29441cde1232f3f02f2c6f8e973aa550b32ebd0e097e3d9bd703e7774ab838daef9e126369ab7f4e23ac8613f2fdab

  • C:\Users\Public\Desktop\绿色浏览器.lnk

    Filesize

    1KB

    MD5

    7320deff747ad588100995979f77c628

    SHA1

    1fab4317d20c0feb8d5d7ed668477e1d72beef9b

    SHA256

    ea46c602cc48d42c0c7c2884b125a68f2b3c62d75e9123ba28d3b917a219fdef

    SHA512

    fd1c6d2ae1e233d3a6249225d4de9e9db31796a2938268e0dadeaa996a235eb1d539798b6690c09e4215181398fb51f47fa9f652b22cb80d54778e5e4c982719

  • memory/404-0-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/404-221-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB