703ef34b6d47c78754c8a1c2507993858d93106b42efd44af71a324ec7c983e1

Analysis

max time kernel
65s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

更多精彩下载.html
Size

238B
MD5

c1c2aaa54740423e5ce2415575c9abde
SHA1

c88b9885c74eaf138b83743d8d34118c65208317
SHA256

d187e927110b11bfb3cab4a50558a0ea4afed287b1ef99c5d9c1128300972ecc
SHA512

c2d9ef6ab5557ea4c2cb93def35133389df3c806c791786c06dc57af52e969e6b247a121896c52bbbcf5327b9910b551bd1205ff22649e8a01252abf73d68dde

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E40ED91-A2B7-11EE-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000006384a4d042b17b7e9c292f14fe26e6dc06fba1c50783ab7198c83c8debd84b15000000000e8000000002000020000000a10139f80c05799bc06fd2509ef38728cba992f074fd5534de7554b36d55a8609000000012495f243dcc9a62bd70c12fb0e6af5ed374d7cac65697d0645886b0e744c922a340859adc7695f6c5d7054ee4ec63051172c9ab4f8226ee1cd030dd1011f2c21e718b8b735a699086d76b4ff46a0e1c82a648aa4af2960071b2f22de7e08f212161688a7c0ac9038f834edeaac8e357c4e0be644f6d0a213069131bd6a7dd57a570ebc2bbaf3d847e8852790b992660400000000483751547226ea29664569dedcc8f036a4e5029b80b7ea874cee7c5e1d7cbe0036489ba590335fac0dee9aeae22f035f11d438bfadcb0669ca679b1d64a54ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d0d902c436da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000cdfdc47ca72bad343d707300edc4c7f751ea894c4c33519abceb1718744c99cf000000000e800000000200002000000090c972d911e7eccf2972ed9dc8b9b4af98915d3e759d35e994ea04dcf6aacc6f20000000894ff001355e319a64ec4d88d084167f77fe433b81ac6cf30de693ae64d8fdb140000000bf6cf32b1db83981791a13a54790e85c3ad228b24fffe68c8b065fc113f254a9079381d1eb6e70970fedfa12eecc36c59d5313a996b977d19e113f58426ace47	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1908	2660	iexplore.exe	28
PID 2660 wrote to memory of 1908	2660	iexplore.exe	28
PID 2660 wrote to memory of 1908	2660	iexplore.exe	28
PID 2660 wrote to memory of 1908	2660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\更多精彩下载.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
eb5357c36fb7269dda9e5de9eea6e271

SHA1
78c50138a1787bd40feeb28cfa2615d5f643d479

SHA256
f31ceb21941489de43025a6ca953f5d339e471778e4c4d729be9c7c680d108bc

SHA512
9ba2e66b552267703f3bb8dec654ebbad5fbe8a3554d2db50d89f3c1c3e72b873b86c5ca413b032f805bab58408838fbf910822b52be9d03ea023ff3259c2211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4770ebd41037853114f2ff3315460c

SHA1
97e9b7e92a7a5a40dffba22468d05a2eaf87f220

SHA256
60003bcde44cc2cc2ad3aa57717e6e42f34006bdfaf34844e98c25b530670005

SHA512
56b76b931e70aa71139a8cfa838c34fd1778e39d5ece601f5779fa8ec0b38d6b0638440220cb9137bb60de46c8767d83d5d2660084ca639be47fd916f9fbd399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a2c1815a33b20123e9d698d36dccee

SHA1
7f49ded15c5f592d1315bd09b98a543dfeb2099c

SHA256
62f72655a76ab7ff7bc8cc48826eae7d9c1ab99014511905d6b9466b21f142ca

SHA512
61784c315af5ef67f9b6e7ee4b53a8ec6c68ba9fc0d059c3c52e68d97a9fcc8ea643c2d9f569082da532eddaa315ea3e38420bb7efbfc1000746a2f00829095e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ee34a3225410cd181c44211f123a92

SHA1
6c1ddd8c3ee26c4b8e402b60aad3195cf64b5654

SHA256
685f5331dc07720a037dac5294da42e1782cb582b563ad4e44700058781dfb1c

SHA512
3d46b0d09d7ca9aa3a4838e7436cc4a534d541b11c9a7079b9fde03863da02770bb22fb1d97931705ea8de7f7c5a66b8d6840927ad9db752bdce4509e329d1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3c1c8373b201b283350e7c43cad7dad

SHA1
58c6737a3dccb26c2865301744e613ef522bf6fc

SHA256
595397de5504c1d2537788bfffbc3966bf699f69f144610b06a213eb8209acc9

SHA512
f6321cc083bb6f618d07242a5871396f8c7a1f1223ef1ac09bcf695b6bc712f469c540e4c8431119d542b717bf5b9a8747887e40af9ba2fa14d4c0908cd6454f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e23fe3e60914350ba25c2ccc3d2e55

SHA1
24d05966a42ab164c1f074a45de07ca65893b5bf

SHA256
e76070558ac5d00850e6f3e45892b1d0fb64c052842d04d64cd32ea792758766

SHA512
65751ab54d2c39c040a9b858c6fe8f7f2ce2fd8a4dec883244df0555ec058d32e22521e2d269534b2f9bb72293f48e91bb7d1be974a8251a2636c9c04f93c682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78451d37ba8be96d5244360847a2ebd0

SHA1
dbd964a6d06b3d4e0229d7deec02940c3ac2fd49

SHA256
d7fccd59c9f7267e910516692e50e11f78acc7f875580da4f951685bd5b44304

SHA512
f58f665e0b14af54bdb6e5ee19aef3a349c563d917b8b6fcb7e91cc117f3ca87c25234bb2f2c321722d7e83772366430d1721d4655616d8e6204cfd0c8354579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3a9c9440fbf8129b07dba66cf1925c

SHA1
955185196b99093a9d892d16667c136ea52f62bd

SHA256
82d9c6a2ca8e6aa47dda4840a4bf58b3ac4b691e7e6f5f15debb937d005c1e2f

SHA512
8d783381175a3e9d1d4ccf8b4312509d6506f31096510b24b2a97d4f75b23543122f2c14975e601efcb717969ef15a6bd2ce1ed38f605fb830cc19ce79ed7894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39857a9b41af5e9a5ba54273fdbfcc1

SHA1
d3c0eed42674c311cf4e487b752fa6582854bdd6

SHA256
6041cae60bf24be362797b9a286d4fa80aa8f1104eda9960c491ba55f1e9a559

SHA512
9dda8064148e9f52ae5a58263cce74dacfd22ada7a75bd89f131479b8232f9e62aea12e1feaa766223bb04d666034ee41c08c8441a50fc72f2bdc07eb489314e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c1788db7cab4852d54d15891bddc121

SHA1
36094ddd1e95ad84dbb58f0e0d5d7d8a9faf26fc

SHA256
022f04bcbf75acdb75efa3e3f9393aad4d31d14eb1c39222b7ca27c225d36dd1

SHA512
ccc33998073dd795b669c456f71278fe80c5da1a5b3ab807c40fae421cb99f60527948b41f67f4cf1124a743b15e214bd43f9427c8958cfd10802f2ad349f0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa34e78f4ba86602b7bde9f66c5717f

SHA1
f3d91d0d9418f0d3eb5aa8fa264dec494c2ca8a7

SHA256
9fe385e581eb33f43c3116d0a35a1e799e090a065b7c7390f4bf9aac482839eb

SHA512
af7971aff7a58fb87d49954a9435f7b83a3f4435e02a565a0b893840dba457c83071cf753fe35c9a5910d7169816bfee1cb8af755ae30f0f1ed1bcd380791304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2764655a93aa0e3d7e478cc23118c102

SHA1
06f233f4fee33d506cf1f9f2f0f595e30e8d90bf

SHA256
2354808da47ee48bf83dc0248ea585b88a325faea990d1663dcafb417b40977a

SHA512
3daf9df8dbbfb54f4faba3ecfbe5aa739f14bb597282dbda43c81f58054ee80d0ed03d99cf1ebd85b7b1e4a1a5fd3913c25ba3e8e7fa8568c12133d2301b20da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541ec47d6dbd6378acd0f5a158c97cdd

SHA1
9a67430083d8a02d8ffa5c413a486157c0e179ec

SHA256
e257c4fec8b9cde54cad5443ac4969a6eac1658448bb99a928a4b3ea811335e7

SHA512
0ecabdd29c6b689e1ac88f0e2e272afc6a730f01b326fadea21b201c4609c452e732d0d305d1f5171538aa39c1eeed0b681bec568330742919fafc1e0e84bb0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6b2b16d89057e4b9086a3526c9dd2115

SHA1
ca3b5b741d69995584bdd22d7f6b85e1f7df6a8d

SHA256
25675b5b25b79d8e5babee7152910b0f4abfdf9fc132d4fb71e15ad87fafbbe9

SHA512
fddda70a3980ae296878201b1888528792c4419bbefc06c484629d2f5fe2d1ccbe03c41acf5b87dbc9ed7f173919646e22c58f86c1332e66af381330fee9f90f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2800.tmp

Filesize
102KB

MD5
eb137c3e47c0904f33d85f7aa2901f12

SHA1
87993afeb82971dc3f3d502647b308cb6cfedbb7

SHA256
bd8d5efc19284990c5fd82e00056392a2909cd45735bd5751a12fd6c725c183e

SHA512
1a754ac50173ea2addd66f729f9eaca5979c03ad4da63820bbdf1a9823251ff0093a05c57544e486396a5715ea10035b0dded9b0b67f39935f550fa491c512fe

Download Submit