435399c0e15824bc4a0c20408ebf9228abe524bf3cfbe8f254119add029ad1ca

Analysis

max time kernel
119s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

梦想工作室/about.htm
Size

5KB
MD5

6d33c956e0833249856030e8aaaf0f7a
SHA1

636203b2a4eeb702875753473b45514d2f1298b1
SHA256

9216c4d0c77b7e7317c453279a3333c523a5aea86990108b7171564dbd9fcd1e
SHA512

ec1bbfc414eba1666088596e40209e74bf3a03b4bc64ac9756592cfb0519040e171b2067dbae12fbf871025eca1f6caebc74fa5c23a456ae6f6bfd96d8441ac5
SSDEEP

96:bikaR6UHxTFUy+8KsmzNtiEAXmxsUxiVDDAX8P0mpEmXp:bBaEcTqB8A/X8n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000083a785c4a1b8903e30026a2804777deef5d81183f962026baffb8b1b07793962000000000e80000000020000200000008849fc09aba2e8beb7febc4042bae9005882945a0a0e89794f1611a231b5c01b20000000c06ead1c4f4cf453e25c15de7243a3d396df073ba3667f1824c5be6430d0ce8b4000000091a81d8e295d7c780a1f949a80e290b566cfae316f9ce6a4b319ef7da0891411ca352583223fa6b22cd704c39516563776ed201c60d6034f39d10ad24723908b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410119710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1263C431-A73A-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000997ad134c6f12d327fc82c773262bc1718b2c52743264b8ff1962e4c8bf144da000000000e8000000002000020000000606924129ac80d814ff66fb71b93792ee7a4a09c166687d75a2f1f762f87721f90000000850608cb713b4501103d652e57aba119ffde726304b8e1bc66a530bb376bc5f5e9cdd75f423939cac79ba7b907ca56393902597895000f3e09317092e0e98add826a31e4bf5592b8ebc7c476e3e2b3c2a82f34f121128497fa115d2fd7bf23f8c3ea702af3a40af94172725809df70a28c49af0a0fc32f79a72ba62a9faffe0a0e8119e7cdb14889ecb07c65c4e6b6dd400000008a4de981528a1fd1dd411788d5e980d7e49cd57cd05cbcf59596269181efff45b70223fea540c0fc932484e27dbf65047dd2cf2033235c64bb47daf816afd291	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ba5de7463bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2744	2104	iexplore.exe	28
PID 2104 wrote to memory of 2744	2104	iexplore.exe	28
PID 2104 wrote to memory of 2744	2104	iexplore.exe	28
PID 2104 wrote to memory of 2744	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\梦想工作室\about.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cad2f4b79c734ca3f95a01d0893bcec6

SHA1
be88ab7bd4a22763a48a09b9eb0dc124b72c5fc7

SHA256
58b683ed2db3e00e06d385c9970be66000f217c52fe08a69998498a6ecc103fd

SHA512
c02903c24cf64a8acfacb38881596aaa21904d5964a2bab14d20d145e25e1b7b67d15b1841d666df3843bffc6dacab94b0eb62795f6856c49810075d95b3506b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed28465a748c4e855fb7cfc3d714939

SHA1
32f5f8f79fe087e35a1b163dcf78e2851daeb9ec

SHA256
24f8f5f68166781ff96d98d68575093f1323551fdf87d9e26275fed43bf63056

SHA512
fe3bcee898a020bcadee8a2ff53a2553f1f3d5fa39ce490d075df82b9cce46d08c80a4bc9395d5bb31ebec3285b77f19709410682b98234b7d2f285c42134237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26f8abd8f0ca10f80e415ff6a7b7c9e

SHA1
150762520b123e555e8aebb0adc31f88238901c4

SHA256
6520a5ad26131a4c772a01d8551220a1410e7adcf3999f22fdef4073aa8786ac

SHA512
a5104e410b6c3cefea6e1d36089a4d8faacd7d81280234eaebded5eb89d6227c3b494350c9d49faa43a2358404c9e07e793b36b491a9f58bbc0526f6156c5c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ca4352feb85e139aa78ab6bf532a609

SHA1
39ae6d932ebcf6777e17f0879bf2cce4add67ff8

SHA256
625eeecb6beafc23a757422378dfaedbe6ffdf46efe961d7d0bc4a792d400850

SHA512
a040facef90dfc63539ca4aa500fdd7474512da1fcbb891460ac47f529bb6461af8b5ca567da19c2139e77cf333fbf5182d745d8ca566bad608ac095b3134002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0433cf7d35e7784060120f443b0fb8a1

SHA1
dc6ea0d6eb9d2d41132798ad5e7bc79276de531d

SHA256
032a6e8eb2e4304dea141316b8983259798d4ae7e90064f98b7c43939f6e83d4

SHA512
2738b2cf4e744499dce5eb3697a6ceb72975fbacb26d2399667e5a2694a6a4e6d4844224c1074c31dbe72500d5260a41a99403fdac2351b5bc2a5547ca0b6ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20c52ade04ce912c08fa42205d2e6bc5

SHA1
1a1fca177a8eeb3155be9a82f21ab26ccaea10da

SHA256
bef674e2a2750a940b5b3add85b78dd397335745e588001357c80b25b88b1559

SHA512
b5ec19b0448e80fa86f9ff40883e4e8bcbf501024b3a92d344d140d48b6977a5b53d30211c0d2249bec4e41577e835e4013888a102c62519a42842e45175e7b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91dc0c243de098114e7c84426bc81156

SHA1
732c5599d5c912cedf9e09892b4b2da45775ff5a

SHA256
7e8eba849680590b5a9254cb80c534fed87e531b5f1d8191eaa1d25e44323607

SHA512
a0dcf4674c19772271e8b0f95414f733bdadffbd0508898e8f127a3357d0e468890062236a33bc184506f28dbfe163b19135882382e771ed6c9f0ee61339d0fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5aa0fee2b60cb1a95667de076fc5b7c

SHA1
e6bec960a5ce2703ca6208487cbe6930ed62fc5d

SHA256
0ee38eaad26f5567a58bf3209fff44ec794ab9de56f337432d4d0569099f1cf3

SHA512
6f45b2ea9dac6056921b73cb098f06281f4d87759c329e701989c62faa01d128404d182bad9fbef8af0155ca7b6736741cc8fb15c48d50ba7e0701e093ffb0c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc97d63eb6e00112829f842570564f5b

SHA1
b65518365580560f11b3bcf71f413c5b2404eb84

SHA256
2a88438dab034e7a83c3b838faace7e6d28764d6e23b0b2da2823859335033da

SHA512
8915da4ffbd2705c292f28832a010d530b2077380d9756f4d54b2d34677db99edc0aae0155aeaa4e5a6111c9b77aebd655e4d8d484815ef0ed3d133e5d893d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8793ba30772f0ac9ea1727d395b4e40f

SHA1
c4bbbc0f0b8a36a9e635839f094726c03f5c2432

SHA256
6428491b71a8c6e95da3e2845ffbe34c8790257b58251586312dafd3dde05310

SHA512
94af6bac8cd0d1d53617342dbf6dd7fb590e6942456e33d6fd90a01e26fe4a36c41fd8df67b000f165a3c6fd1c0c53dd78ddf402d9d256cc9167802e3968a899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ED2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F32.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit