b1f62290c96f07164d2e7a230a430cfee9acccc1adce1f46575b23292f186b2f

Analysis

max time kernel
108s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073f3d78667879ea622f97a0f446769d.exe
Size

54KB
MD5

073f3d78667879ea622f97a0f446769d
SHA1

36828e6fb32b2ac0ece118febdc9a5a2edd6fb45
SHA256

b1f62290c96f07164d2e7a230a430cfee9acccc1adce1f46575b23292f186b2f
SHA512

37b192fb2dbc74f92d62c634aca6fd5e739de195991e06e25ff64407f79f53c9ed953333727a1ecff8d82d9177bf169ecaab45024859fa92812b877b4580d79d
SSDEEP

1536:rIwlY1oWU4VC8CZMjCsiea/IeaPZBVbehu:rG1oNIRj+wfsu

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5048	attrib.exe
3108	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	073f3d78667879ea622f97a0f446769d.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	inl27B4.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5016	4260	073f3d78667879ea622f97a0f446769d.exe	111
PID 4260 wrote to memory of 5016	4260	073f3d78667879ea622f97a0f446769d.exe	111
PID 4260 wrote to memory of 5016	4260	073f3d78667879ea622f97a0f446769d.exe	111
PID 5016 wrote to memory of 1388	5016	cmd.exe	113
PID 5016 wrote to memory of 1388	5016	cmd.exe	113
PID 5016 wrote to memory of 1388	5016	cmd.exe	113
PID 1388 wrote to memory of 3608	1388	cmd.exe	115
PID 1388 wrote to memory of 3608	1388	cmd.exe	115
PID 4260 wrote to memory of 4080	4260	073f3d78667879ea622f97a0f446769d.exe	116
PID 4260 wrote to memory of 4080	4260	073f3d78667879ea622f97a0f446769d.exe	116
PID 4260 wrote to memory of 4080	4260	073f3d78667879ea622f97a0f446769d.exe	116
PID 1388 wrote to memory of 4604	1388	cmd.exe	119
PID 1388 wrote to memory of 4604	1388	cmd.exe	119
PID 1388 wrote to memory of 4604	1388	cmd.exe	119
PID 1388 wrote to memory of 1912	1388	cmd.exe	118
PID 1388 wrote to memory of 1912	1388	cmd.exe	118
PID 1388 wrote to memory of 1912	1388	cmd.exe	118

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3108	attrib.exe
5048	attrib.exe

C:\Users\Admin\AppData\Local\Temp\073f3d78667879ea622f97a0f446769d.exe
"C:\Users\Admin\AppData\Local\Temp\073f3d78667879ea622f97a0f446769d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s_g_l_229.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      PID:3608
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3608 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
      4⤵
      PID:1912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
        5⤵
        
        PID:4116
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        
        PID:4540
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
        5⤵
        
        PID:3212
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5048
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?S"" /f
        5⤵
        
        PID:3148
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
        5⤵
        
        PID:560
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
        5⤵
        
        PID:4268
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3108
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
      4⤵
      PID:4604
- C:\Users\Admin\AppData\Local\Temp\inl27B4.tmp
  C:\Users\Admin\AppData\Local\Temp\inl27B4.tmp
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl27B4.tmp > nul
    3⤵
    PID:1428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\073F3D~1.EXE > nul
  2⤵
  PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
790B

MD5
b18422bf438bbb7798280375a7bc0976

SHA1
c1b77b35e3a38ff2ad119f25e548beb5ff68c2e2

SHA256
ee8709e751067193dccdfe218108bdae6a30919d7b6c860bc848c7cc4b242fa4

SHA512
23cb9c74905f514a2bf4ef91afc53ceb08230b3ce68e3eab17bb36c674260d143a7e7105958ff4ed5c2a416bddffb3c7e28dcf8060cbf323c7e4cab71f613176

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl27B4.tmp

Filesize
342KB

MD5
a748f72c8b6377a5d0cbec304ba396cf

SHA1
473099f49045ffdeaa77ae11d71667413c4442af

SHA256
fe97bd67dc91de08c3df7a94b92771b2b24cb4e0c00208ecfcaa97a06ce50804

SHA512
27de0367c712a2eab5ecbec0680970251b0355b77dc70ed358d5eb790c019825c5c57a5866aea954bd27809323d156784b3a71d34b97fc5b230b0f08b3b7d4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl27B4.tmp

Filesize
342KB

MD5
000813c28e09b37d100f244b764821a7

SHA1
25b67bb11677236ff68f26495b427dd5aff0656e

SHA256
a766169d08bb3bbb351daa02ef3e2d9bb9f4fd68db613a85f11297a1670ced40

SHA512
f5d30e20405d8cea35474317263d39f17dfaaaddd9327c6f55717b3d7773cbea7fca2d8c471af2d42c41e348d0997f4e90af3b348e8e9be64fd1dd6332466aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\s_g_l_229.bat

Filesize
54B

MD5
504490369970f1c0eb580afbcdf91618

SHA1
b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

SHA256
a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

SHA512
5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.bat

Filesize
3KB

MD5
b13d4a59d37d8c293276a4c428ad5659

SHA1
710bfa65cfd533b78c564e15e0bbe954e9265ecf

SHA256
3aea9dee221648916706758561e23796b2325e4019b28a3070fe2fd8d1d4ed28

SHA512
8cb3aec7463cf7d14f333bb9257f03c7f7491f4da4fea3311e505f99b9f6797f0aa3f689355a6625d9f104b8511f7e75218b4c2fdd7f9ac96927d7aa4a6ed0ba

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
348B

MD5
5a2ee8346e676499a5658277e98b2317

SHA1
34a8d363b3dac690a251e181b3522b3d9e7ffe6e

SHA256
4e367269b4b19b937a7f7a420613d2a69e96aef456dfd4b4f6853c1e92885cca

SHA512
86f575fc7816ed33ef996e6385bae144c4d750be44f59dd1856b7f601b5291960f522153206a38de75f942537b280c2b49a1c038ba82faa36b9e903354ea9242

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.bat

Filesize
3KB

MD5
185a49cc37f1724dc196f67c42a76340

SHA1
27fde7b9ba462fc36ba5705832ae44b454d718cf

SHA256
3fe8fbf78cb9855c0cc663dda80354318fb2c7ef1dc4d378c98bb1383015140d

SHA512
97ee31a378404bae99616a057ddbed8450f56bfd5d0508b4cc3b864e73aa5d8d1f15b21c82ed3570494603ac90bb7cee1b8cbdae9d935bb1ddb71264004e4c22

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.inf

Filesize
248B

MD5
2197ffb407fb3b2250045c084f73b70a

SHA1
3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

SHA256
a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

SHA512
b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

Download Submit
C:\Users\Admin\AppData\Roaming\redload\4.bat

Filesize
178KB

MD5
5da4168e9a4c93fff629dc1040485663

SHA1
9d9ded9f3d8850d3f29a5ba41c948ab00271a77c

SHA256
db71ce8ea6e2f35a71b5aa4ad264d9e757b2ec7fd455153df4dcc4969cf354c0

SHA512
52fc8c0db2db4b91fd9b48b58702927714ac7dd49d6ec1fbd4efa716ca25d73e0554b10b188f34eb6620cda8bc19972b3e1b1041dac6f1fe665b75634d55a661

Download Submit
memory/3608-95-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-113-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-74-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-75-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-76-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-73-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-82-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-71-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-70-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-69-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-86-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-87-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-89-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-91-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-92-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-67-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-139-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-99-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-101-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-94-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-116-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-115-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-66-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-72-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-117-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-112-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-118-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-119-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-111-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-110-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-123-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-125-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-126-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-133-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-127-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-124-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-140-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-142-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-143-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/3608-141-0x00007FFCF2B60000-0x00007FFCF2BCE000-memory.dmp

Filesize
440KB

Download
memory/4260-0-0x0000000000A80000-0x0000000000AA5000-memory.dmp

Filesize
148KB

Download
memory/4260-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/4260-5-0x0000000000A80000-0x0000000000AA5000-memory.dmp

Filesize
148KB

Download
memory/4260-7-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/4260-29-0x0000000000A80000-0x0000000000AA5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads