9267b7e0a1012a6172bdcf70c0087ea713ead01a90623064269bdd2c232b07e9

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03dae5e5db9ad479709d3cadb6764bf1.exe
Size

32KB
MD5

03dae5e5db9ad479709d3cadb6764bf1
SHA1

4503c31b2fe170e0b6b8ede391f097bc3d682c4a
SHA256

9267b7e0a1012a6172bdcf70c0087ea713ead01a90623064269bdd2c232b07e9
SHA512

35e032587d3906045b259df9b77007de7b4a4d92cc46ef57ed1c33fcaa3b2630abb408965a31de207b0cace0dd5f112fe2355510135f5624fdae53ec8f147ce0
SSDEEP

768:6pwkaVpVWusK6BC3ne9QeaOQJP6coScckqRF1UtNPRaj7:6K/kxK6P9QkQJinScXqf1wPu7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LoveHebeA = "C:\\Windows\\system32\\vlstasx.exe"	03dae5e5db9ad479709d3cadb6764bf1.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\vlstasx.exe	03dae5e5db9ad479709d3cadb6764bf1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\vlstasx.exe	03dae5e5db9ad479709d3cadb6764bf1.exe
File created	C:\Windows\SysWOW64\vlstasx.exe	03dae5e5db9ad479709d3cadb6764bf1.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1286789682"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079096"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079096"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de6221000000000200000000001066000000010000200000001e5824b1b17af84ed16cf7d4cdc122afb1e354aed1be2de4a74fab63617585e6000000000e800000000200002000000073b6e54934f68ac006181ba1f59b60b21d11b7b82a37b7ea4e44ae1907d914c120000000fc8a12ee46af10681c14b7608d7fa2d7ef3677b906b2b17dd483a26acaea87b740000000b6fc4aa321aa49fe1e02bf7d18553185ec74efd87ebd17dbdff8e103916958d0cad92c27250de417e9166ce2d8122247cc8e57c1a288c819344fab1beaba1ef7	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000a10b24206e98b445c0286547fb0fc1af583aafdff0b04e2a1a01c5e40d9fc0e4000000000e8000000002000020000000e8cfcb4a491729b7082ea47eda89d4a7eba1bd80bc8e52d661ea375c29b1fe12200000009ef10d6910e781bc37a9dc3c828695588fca5134813af2c63c6719cbd056ba9440000000183e60fba8e3f8848bea47673edfc57cbb043ec61c1ecff209397d72d89028ed3bb698120a1c7a453cdc71a1bbfcc05978479755e2bef7f490cc1127af1e6fc0	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a56154b83ada01	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079096"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1286789682"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0876654b83ada01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1271008169"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7766CF5F-A6AB-11EE-9ECD-CAE9171F1CAB} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1271008169"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079096"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe
3192	03dae5e5db9ad479709d3cadb6764bf1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
704	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
704	IEXPLORE.EXE
704	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 704	3192	03dae5e5db9ad479709d3cadb6764bf1.exe	100
PID 3192 wrote to memory of 704	3192	03dae5e5db9ad479709d3cadb6764bf1.exe	100
PID 704 wrote to memory of 1308	704	IEXPLORE.EXE	101
PID 704 wrote to memory of 1308	704	IEXPLORE.EXE	101
PID 704 wrote to memory of 1308	704	IEXPLORE.EXE	101

C:\Users\Admin\AppData\Local\Temp\03dae5e5db9ad479709d3cadb6764bf1.exe
"C:\Users\Admin\AppData\Local\Temp\03dae5e5db9ad479709d3cadb6764bf1.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  Open http://www.sky8000.com/sina/tongji.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:704 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1102.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
memory/3192-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3192-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download