541d4eb22d645ee6a7f84519078bbe1b4c5e36f4f419576675fd0800d8cee9a4

Analysis

max time kernel
119s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

广捷居程序gjj（去后门版）/wwwroot/ad/ad_02.htm
Size

832B
MD5

04d1fe4a5f86b1551919c41abc32fe17
SHA1

160a5261aadaa3bea05f302d1ab44fd9517168a7
SHA256

afa428b510b3806ab2b529a911a506ac6141cb13aeff971ead4c84caf6dc352a
SHA512

d86868850b12278c40fcb46848f5ed0102c6b75a32519ea7cdc0e456fb30687ad7a734d8d81eaa464de40561792c1de1d7bfaa930fc4349d78f1c7bb024cf8df

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DBBF9D1-A6E8-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d1690ad854a19d7dd747c2c17579a7db9d825c9c4622dc0b1bf2c63ef47ecdea000000000e8000000002000020000000b280df812a3b79f5e446f9c8fdea02f188a8bb2e3ecf825cbcc3263296cf43f120000000b9d9bc915079229f1e6c62d3992683f54bd2ae1dd453f90cdcaa72b67dc9db2b40000000b061235025c8773a7f80d374afdcfa75140bcc2e101734b886fcc66c958aadb2a876ae2e355d50286d42c4166eeb0476c0c1dd4a20c18a000c6baa023edaffdc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104fd9f2f43ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d1a0a4ef436dd27f784f9ec76f784d0b2e1fecde7cadd41c6d0f2afbf15e97a6000000000e800000000200002000000083856b7749dac15396e829aabdba2e5e319b6a6af910e2bb8e77fac9652bcc5b90000000c111cf30d2906877092121f646e513db3fded5a4de7bea90d6a40c39f94a28a45a36eafdbd7ae0f0a66f554ed6daf01a8711dac43ad15fa42f2be7f4f0f8bb9008112b4eeb2dbdfe18682d568101d7a5e11a789fcb0a94ba72c82fc849a97742de32a486e89e487e469a5907fc53c5f4c50e5429d804103f6fae3da5da316af0da527dd87ac1023894bdd6dbb97ef4b840000000823018b6b72714896fad07e5ba351af9eefc7d79c6f5a5d59d6935dd5c9e6b515aa8cee48b96267490a76cd0140fbd39b33c5ff12c17de9bda9cd3bc0a7293ff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410084515"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2160	2184	iexplore.exe	18
PID 2184 wrote to memory of 2160	2184	iexplore.exe	18
PID 2184 wrote to memory of 2160	2184	iexplore.exe	18
PID 2184 wrote to memory of 2160	2184	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\广捷居程序gjj（去后门版）\wwwroot\ad\ad_02.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
359c29c6a68a8b791cd23f7134da8816

SHA1
d4097149476b20333cc2a5fa6fa346bb248c5461

SHA256
112628d05095d1155880c8b9657e7cc29b2532292cbfaa3b2debac983193818e

SHA512
dea5e374d75df3361533e10a406b4e824286f46c18e9044cfb598e75cedce90f0be996e0a2ba1091ccb85e0fc77aae77e56d2ea9e66e30d936e7aed00636fad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6ca2f5c475ce8df7b4b1c99dcde02d

SHA1
636a6ee2b4f0655560d7ec60a25e884d98b2dc24

SHA256
2fba5d9491b7cf4036d579f12636451b10f505f5e38a6987771571354ed53add

SHA512
b60755d44600c4121386abc8b505e84255cc4287bb4442b55fea3aa160d1feeee80690dc9ef1453a7023e10c42340be9b68339b09a52c5622fab983a3c81d35b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc9fb841d3c8d97335aab24d929df88d

SHA1
e5778f20654a7912742c6467168e69ab55a5ea4b

SHA256
9ba1f5dee18e1256a3d6af72c26eb818b5db2784f958525c5f9f8f6693ba7d91

SHA512
6f895a46d85a445fcf3c3288c48ecd727c544f475e895c18042371de0c5d462eecb0706a0c4d1f85cd4fe8b60ba19fdf12cbcc304dd7659be454f216d7783d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb711ed937ed636fea5046ff1b2892cc

SHA1
748cb8f565c5f5381e7a940dfa6fdc36cdf9e2ae

SHA256
fb096a51f555d36d27004ed0d6701cc7126b48e13a6e38de467d2a9d08d7561e

SHA512
b6ce3e830b6967e343b0455574513f37a286951a15f64ae943fab31bec96b86b266a51a74bbd0d0e27ef810994dd428b77166cb67800d737bcf21540e843ec83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5699891e55a9435ae6dfc7e1fcbcb38

SHA1
3ce39ddbc5b329ffb927e3b67ac2236cd5095c65

SHA256
88809c04a475c3c5cc7f1712aa9603ac8297377056edae04ef89b8bdf3640734

SHA512
0a0fb5ce9052741d1ad2a79c26a4b1d18c815bf0e8e68220c41579a77e3d7bba3b7b52ffc6b1a082d40b8fe34d58d6d28df4b99e1dfc14bec93b919289099e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
725a86fcc1e4c2bda469cabcd6daa0e4

SHA1
d7bf428914e97669ece7c684ee75334bae2a916e

SHA256
3bdc596d7ab94f26177f4548283e951bc50a4dd900c45e98388579cf73e72ad6

SHA512
a18d38d882416a1402865fd1553c4b16980a0d31a41ae4031d35c2ab32de371015ad64c9d5e3388040b933f57b3c2fda05ee5eac32c336bb87964c63ab833e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc81967fdbd295bf8bc7c4053f73f705

SHA1
dce17243bfbadb0575e985f0886f072bc8f79106

SHA256
3f2bff51bcb5ed7708dc29eddadae3b3111aa6b7afaf86c901874380d5c526e1

SHA512
668972b2c0320b55d2cdf65958c5b736c4ab401ee96e6ba1af85c3565da3438f9965ed7bb7886be547ba4a0ecfe5ceab08127dad1710ea5f5562468392d01a42

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA91.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAA3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit