Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 22:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
164a66f78a7e1ef93debf0417c72690e.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
164a66f78a7e1ef93debf0417c72690e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
164a66f78a7e1ef93debf0417c72690e.exe
-
Size
129KB
-
MD5
164a66f78a7e1ef93debf0417c72690e
-
SHA1
f4941a20e677ba2189a9553697e26e3e05029549
-
SHA256
e31688473a8763cb942525ef6690104437e826cf167a9ab4abb5510425b6de6f
-
SHA512
dc404e79ac6c90423bcaed5672e98837843b361eca7dfce6df85371a1fb21e31f5cd9d6b007ab290b9927632125eb8948c95019e359aebe84af915d033e86a01
-
SSDEEP
3072:34eYZ4+1JXJJR3Kj78pG81s7eyUpy0gA2FGBqqPqwvqRNE0Dq:I5O8l3Kj78pNS7eX/dbOyb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3948 installer.exe -
Loads dropped DLL 55 IoCs
pid Process 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe 2552 164a66f78a7e1ef93debf0417c72690e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\taobao.ico 164a66f78a7e1ef93debf0417c72690e.exe File created \??\c:\windows\xyx.ico 164a66f78a7e1ef93debf0417c72690e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\TypeLib 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\Shell\Internet Explorer 164a66f78a7e1ef93debf0417c72690e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\ShellFolder\Attributes = "0" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\TypeLib 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\TypeLib\ = "{69AA2BBA-B388-42ED-A524-CB33F4711B54}" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\ShellFolder 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\Shell\Internet Explorer\Command 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54} 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.pp2345.com" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\TypeLib 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\ = "ÌÔ±¦-ÌؼÛ" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA} 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\ShellFolder 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\DefaultIcon 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\Shell\Internet Explorer 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\ShellFolder 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\Shell 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.toulema.net/taobao/taobao.html" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\InfoTip = "Internet Explorer" 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\DefaultIcon\ = "C:\\Windows\\SysWow64\\SHELL32.DLL,220" 164a66f78a7e1ef93debf0417c72690e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\ShellFolder\Attributes = "0" 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\DefaultIcon\ = "c:\\windows\\xyx.ico" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\Shell 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\TypeLib\ = "{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\Shell\Internet Explorer\Command 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\Shell\Internet Explorer 164a66f78a7e1ef93debf0417c72690e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\ShellFolder\Attributes = "0" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B} 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\Shell\Internet Explorer\Command 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\TypeLib\ = "{DBEEC126-4924-49C0-9872-B2B57FCBC94B}" 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\ = "¾\u00adµäСÓÎÏ·" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\ = "Internet Explorer" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69AA2BBA-B388-42ED-A524-CB33F4711B54}\Shell 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.131.net" 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\InfoTip = "¾\u00adµäСÓÎÏ·" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDBBF733-5338-4F7C-9CF1-F3BC26FB2EFA}\DefaultIcon 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\InfoTip = "ÌÔ±¦-ÌؼÛ" 164a66f78a7e1ef93debf0417c72690e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\DefaultIcon 164a66f78a7e1ef93debf0417c72690e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBEEC126-4924-49C0-9872-B2B57FCBC94B}\DefaultIcon\ = "c:\\windows\\taobao.ico" 164a66f78a7e1ef93debf0417c72690e.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3948 installer.exe 3948 installer.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3948 installer.exe 3948 installer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3948 installer.exe 3948 installer.exe 3948 installer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3948 2552 164a66f78a7e1ef93debf0417c72690e.exe 89 PID 2552 wrote to memory of 3948 2552 164a66f78a7e1ef93debf0417c72690e.exe 89 PID 2552 wrote to memory of 3948 2552 164a66f78a7e1ef93debf0417c72690e.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\164a66f78a7e1ef93debf0417c72690e.exe"C:\Users\Admin\AppData\Local\Temp\164a66f78a7e1ef93debf0417c72690e.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5343a2af51b007d0eb401e0b6aaa85d50
SHA1ccecabd9b64672d0ee7b5bebfc19a4d8099d589f
SHA256cf0a450d6c07dd1f03a9364915e5869b7ae922faa706b1fc11ef6c9f19c79267
SHA5125eadc31fb22b7ddc8871a939fbc8b80f53bd469146cb1d678079299d20881d41bbc8808413104d598083607525d3f05332054e07789707a262c4ce6adf428b94
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
4KB
MD5073d44e11a4bcff06e72e1ebfe5605f7
SHA15f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA256b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
SHA512e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667