c605f05f3b3c4bbfef633280d32e2acd7d61224949a117b377da15e6c9f16728

Analysis

max time kernel
135s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

使用说明.htm
Size

2KB
MD5

f167320d5d11be52e7332b943ccf0bf8
SHA1

aa265bc6fb9043ac4729a5bc8aca338be0022e2c
SHA256

6cff52f54f3d9c0de6e0b231d3cc06a4ea8ea4c15fe19e20f57da2ad77369bd9
SHA512

f94dea5edefe16b06c7fe2366ac24001fc7ffd709a5971bae9bee5fc12164310dfc460c733ab48f83396dcde318d7948ff961d007bdbc78bcd8aa9a9101c899a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cd20d83a9836e3cdce2b39f634b806fdaf7101485ed9bbaa762aac8149d6111b000000000e80000000020000200000006f3bbbf60fed497bfc7e97fac09b8611f786724e29950de800e9428d5ca33999200000005d8555df8821d4c01442e52f0af2b29e804b815a3e501f1b614d46779ab1e61140000000dc632f7b65c39c69ee18ade370abea3a66bbc67c39f7be841a07c1f5814368d86ebea2b543f45971cbb5e227f544a713550a6ff07c08b5affd42249710a89b6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005eb8022d348b90ac79ae6877cc90f57f94f5dc3b8a3b5b423a1eb5160c61a6d8000000000e8000000002000020000000d22ecadb1ceab8f3a41d011b55f5467c3789f09765e3ca3740a9355b514de6d390000000658ab8a14c63989ad45dc8db8d3175fea0b05cd0c9aceb4dd9ba1665d91f84592c1d7db304bc439bc9dad3cfd39c3819e7f64920770358a8e8b5fd0414e32f42b03f3a9f9dcbbfa084539608361691d97a0b512a58105d4e6169ddc61934ebd2a8d23637520451cb45db93835f70ee1b4036a2c0dffe4b5df10909ed50f3d21356c5c755085734c70c574dd384ef350640000000ccf03467fb51600b7dce77b640fef1d6e1dc363b296392f0f49058f7a34dc36e9d525ec76bd2c792e4aeb5b4bdb8f83760763e3bd09e7c94e59de8db9c5060ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DAE2C51-A54B-11EE-B190-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409907234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e2592a5839da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\使用说明.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c4746a9490ab5bd854db15c389c792

SHA1
9707bf8e344dfad23fffe67f249db304d141c4ae

SHA256
7e33e34f5f748192a2dd212f2616dd9350f27e07893220c95adfc0163da13e6c

SHA512
69f3097677fc83df1bc14634a269532aef046ef13ec7197c424c11f1169165f2800bf8cef3bb6d5e5715bc765cfcfb88dda4b6f7bd7f049729cfdfaceec2944c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d952c13479e97948994e511b0c6bb9f

SHA1
9391ec20f436a0907028bd0b31f938664b115ae1

SHA256
cbdf11297db7552417ac3a574c77406946feaedacb9af4233560294d22d82514

SHA512
710e14d1d321d1b30cd10aeaf4fe7b4e90913e7ed82e209d81e0e6c27aa7ab8fb8125e0064dbd994b660366274d17c3bd2db3db7dacd4f8170e39f18b85d074a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f82a858992a0d5b6dcb8f89f8b3fb38b

SHA1
bb69f1f4ddeaa867296903ca458d267c47ba3629

SHA256
9fad249ed2bd554028ad7d7055fcaba998162db67ab55ed0bf4595c50f875713

SHA512
c85c9a1c6d2d6d2dddc120483ebf9f727c60b6b0a1425cc281a83d630ec788072446317161d776a1ae1333ecb250a9ffcb427b196e333e89495208b97d47069e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a440fe5211d8e2ebd22c490f9e45a017

SHA1
d23c7aef4e829e140b3fbf1582e53ba613032a6f

SHA256
abe5822a98502fb37c0e631a52c2c0a866cf7b7aaaa173764c6985735a050523

SHA512
19b75f523fc91ba58002f62635e72d1be4bb8b279f2fcfd7e4edbf4912a672ae224fa927df19fca5924419123e72c7701021c432b6726e55f1cd1886aea06e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ac06cb5ccc01a3dc2be6e2d02b9f31

SHA1
eedf74a84e9b685b27a0830daafd18ecdd681742

SHA256
6be9fdc768de208558db2f0473656a1b39329611fa0742bf6519e8b055cb1306

SHA512
25f23392f17fd48f42def12a24a08c4e72ef8a4df010419c5ce734eee7c5c50f33037df86e8c4cdeac74ef01fa2fb6b0c319298dcd945df3e003a2ff20d13154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888d2e2709e5bf4ecb99fa6d6b8e14ba

SHA1
db559f0c73c6600872d76e1acc3ce817f1f48f0d

SHA256
f331bd71fc3bd59e6936b2fab523e22f00e2042b5789a2544b7330d1c9d5eba3

SHA512
c60f6b3d22a64db176809b83fddf1ac9309d4fea65a80e1cc1a5e74bc75b31b2b1e5a4a7bdce7ee4b1ec4fd692043ea64f4bb2b3097f194aa2640cd0f65ba174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f046886058009453a0e3089b3909ae7a

SHA1
32cb0ba06ab8e93789ed071897e0a26de4f75abc

SHA256
151ef3bb41ff136033dbeeb6b382d8b5f6a1cbafc1faf28de8f69139415006a4

SHA512
2f7e486ef2032a22e3d78d891169eb05622af8180fb157b0f360b0f192c974e40aab9ff860b433ac4236468aba1acf23a0aacec12992bb07bdb234f247ba35c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC765.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3E8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit