1622de62faa9521a93d85c87121182a6fd225c1af429a65d4c0e47a02c625f6e

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5089e26a81cc332245f35c6ab02f1c15.exe
Size

67KB
MD5

5089e26a81cc332245f35c6ab02f1c15
SHA1

b886ffc5f46e74ac6ea167525d1d028821944ba5
SHA256

1622de62faa9521a93d85c87121182a6fd225c1af429a65d4c0e47a02c625f6e
SHA512

93b252ba6c59ce816d6b7dcfd2d4b2a5c32c80f43f5a92fe0fbdf90c80fbe362854f6cdc511ed04171522b0246b68f32c1d0f1571c330553dc33d30d8d9a7375
SSDEEP

768:yHDiTqkQrcyXSwYKXZnqAAWoUV9HsUp00im7lo6Dx6ziaia+Jre0UrMUnjG56gH/:4+TqkQrBzZqzGtupm7y6Q9RDkVE/S/T

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\iejore.exe"	5089e26a81cc332245f35c6ab02f1c15.exe

Deletes itself 1 IoCs

pid	Process
1688	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	iejore.exe

Loads dropped DLL 2 IoCs

pid	Process
1720	5089e26a81cc332245f35c6ab02f1c15.exe
1720	5089e26a81cc332245f35c6ab02f1c15.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\iejore.exe	5089e26a81cc332245f35c6ab02f1c15.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Del.bat	5089e26a81cc332245f35c6ab02f1c15.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iejore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "www.jk155.com/news/buyu/info-4052.html"	iejore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "µã»÷µ¯³öÍøÒ³¹ã¸æ.¿ÉÒÔÓÀ¾Ã¹Ø±Õµ¯³ö´°¿Ú"	iejore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.jk155.com/news/buyu/info-4052.html"	iejore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3040	1720	5089e26a81cc332245f35c6ab02f1c15.exe	16
PID 1720 wrote to memory of 3040	1720	5089e26a81cc332245f35c6ab02f1c15.exe	16
PID 1720 wrote to memory of 3040	1720	5089e26a81cc332245f35c6ab02f1c15.exe	16
PID 1720 wrote to memory of 3040	1720	5089e26a81cc332245f35c6ab02f1c15.exe	16
PID 1720 wrote to memory of 1688	1720	5089e26a81cc332245f35c6ab02f1c15.exe	18
PID 1720 wrote to memory of 1688	1720	5089e26a81cc332245f35c6ab02f1c15.exe	18
PID 1720 wrote to memory of 1688	1720	5089e26a81cc332245f35c6ab02f1c15.exe	18
PID 1720 wrote to memory of 1688	1720	5089e26a81cc332245f35c6ab02f1c15.exe	18

C:\Users\Admin\AppData\Local\Temp\5089e26a81cc332245f35c6ab02f1c15.exe
"C:\Users\Admin\AppData\Local\Temp\5089e26a81cc332245f35c6ab02f1c15.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\iejore.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\iejore.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Del.bat""
  2⤵
  - Deletes itself
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\iejore.exe

Filesize
67KB

MD5
5089e26a81cc332245f35c6ab02f1c15

SHA1
b886ffc5f46e74ac6ea167525d1d028821944ba5

SHA256
1622de62faa9521a93d85c87121182a6fd225c1af429a65d4c0e47a02c625f6e

SHA512
93b252ba6c59ce816d6b7dcfd2d4b2a5c32c80f43f5a92fe0fbdf90c80fbe362854f6cdc511ed04171522b0246b68f32c1d0f1571c330553dc33d30d8d9a7375

Download Submit
memory/1720-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3040-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3040-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3040-38-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads