e80ed7363610edf1fa4b371eab11755a738951d696909c5b815d9b1ed0f71295

Analysis

max time kernel
156s
max time network
172s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQ免费资源网 v1.1/404.html
Size

2KB
MD5

343f9ceb283a1d2e8f58df5c556df130
SHA1

488316c1051b88eeb719693df08601b328ae03ae
SHA256

0e6caefad86b2c2a6b026d737e5c8b1ff38acf2c8ce30fee5f2806309353e541
SHA512

d8e26c05b826b261ccee913722ff670e05fd00c9aae003a7587510e7c36e5f186e1e6c4d8cdf1d6d34d345382452e18dec672402519736e500f9af094b9f5832

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000015a4bb5bed1f3e348b9725bb39975a613400b7ecad976ebe4ef87d9a999a473d000000000e8000000002000020000000865d412858238fedea9f55c96831aa3be8a2f6f4f5de23cd616f29eb110c1b8c9000000081025a083ae67e9915785abc8def6aaac58004bc3aef4f828b73a37bd57e1557d4c29489fcdda79996a63388db86e35a1738d009a67f1e7247e3314c91d8e7a21e01190a54a9ecbb7c726eef88b166213d84a974e26fd1ab63ee4aa8ade3d4409ba3bbf79af0409e6a942694c784386850eb0b5954f816eb70a608faffec76b0106dc1e1ccd2a85a323795f3dab133b940000000558629a054ce9053d0070825f472b4b4d8b1ac1145609160f788b7f2c01b67a7962ef6db0f2a775420c52a9a7606b4dbca14213d3744b5ca5c247542b786da40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000811b5bcb650d21562226492d661c4bdf737144a772b77a4a873c8bd1e49bf4f000000000e8000000002000020000000b63d7d6fb29e2d8e411821b9dd309ce0874f944fe811c60d05d39e4162127c8820000000469a7d14f1415500f2bf540a6d53ddbfb5b15850d5e7f60b5f574bf3560096db4000000088dd4f9a4031d308b12fed0d363439e9904c65c55913ccc87067c900629d70b2702c3ae3252f48c3a4d939c5239426cc2d67c4e98f26842855bce4f2dc6e9fb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EA6BF61-AEA8-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410936797"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00450d4db542da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2736	2724	iexplore.exe	28
PID 2724 wrote to memory of 2736	2724	iexplore.exe	28
PID 2724 wrote to memory of 2736	2724	iexplore.exe	28
PID 2724 wrote to memory of 2736	2724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\QQ免费资源网 v1.1\404.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8d6f271764cd645187eb917ffef6d4

SHA1
7054901272c3e1ad0a3b133320c24bcdfba4a944

SHA256
d82e0038e5835352be5a9b1cf710f78cedd07719f232eb86ac4bd56d4b8346af

SHA512
9e8c3ed4f53725d5bfdca942afdada02355991b830dd1355c42d17289782270d4c3579e1af0612e3dc4425fd4aef8e7748b387c9a3896e1a255a148f0b99600f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff878049724391f01d266775a4eef4a

SHA1
b90f91a8efc48f20dc2ed2e8cd6eaf4387a08f62

SHA256
9fa0dd809603ec1c77214e7889119be83e1c53f6c81c26d256491171c00fb13c

SHA512
f7eefda76dd776d3a314d571ce05aa8deb01fc3d45b353e78b9968ae7b5cda53ac4a012656b2fbbb2f8551e7c052ce3572893e36b6bfbc78d505f6aabb8f2a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80f91b8d0b23d643e48d4e4272ef11e

SHA1
a83fe696e77980a9584172783ba412bd07b19182

SHA256
e8185793ffc89acb63319c020241e59c78fff00403e44437993b38715418655c

SHA512
ca54e2369e5b0cb723e3b04fce1bc5cd06479e12d7a80dd76c5a23e49b6cfa4ec61705f39cc86359c4e9c554fe792e1d06c3744f7a04c3659a9b69a38a67bfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f8c9891b1ff59b1717e92620f4831d

SHA1
531a9b796bc680fff88cd115e24cb9e3ec99222c

SHA256
d2863a98d79bbd234db1b825c5e6e4f9a14ca51630afec968f996c2859bff4bb

SHA512
31c66c5fef33617b4b4122bf85b2d0c40cc9d19d42242a86e68eea33148cf5c893cd92577b3c1bbf970eba3ec965c5d0b37c81f0898dcccc2f9117efdb1c4c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e4695e5ffc6a0b6d59713eea151cba

SHA1
f7d69f1ea5ed9f74b5a7a2f6f08173f07a70d9d3

SHA256
64cd3f10a407c5a7fb0e382d33461c7f7cc5a4eac111646be760fa350cd40c06

SHA512
775bb8c6b79dc1b552a71d27b0ed000b29502d9830172adcd19524e37b611b5696e756ee2f6d08ea3d2d891ebe0b7f828f6b12d567f571fdd9a6ebdacdb60775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0d94e8e9f0f4b0b435f7d4c8559bb40

SHA1
050f56008d756e973566e5aeab1b3fcf5595a705

SHA256
85d2b5e98c4d53873403950275e297c9403cfd321ec8cecde8c29d337bd1e5c5

SHA512
b7d81bb6cd618b9799934affe6bbca80583de4e7fa0a967f0a596ec5bf278b873460ef7c22a3b789a23d2616d24d9dc146bfb90fcb4e1dd6846931276fc3ef69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79e2508e53aecc7b772724d9bf9da2b8

SHA1
23dd95e7872aae63b66570ea710d840e05cb0560

SHA256
056e14de49094f4c1f688573d6b10bfa3592d585788ba602372b05e1adaef16b

SHA512
bf00ab57dfa06873afe01bb8eea1bfc0913a7c697b828086bbf96531466decac1225473522471e145be6f247788c9289791a20c932ca0fe9f2d65d828fd4b434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf6101705b7c017d8584640740221e00

SHA1
06f98b817ce5c06f8d354e5bd93d90fc0921307b

SHA256
83c5adbe209d924f92932b38aad1085b4b7b50767d7d190fcb12eb45620cc00d

SHA512
26548ce35612f11f0fa2ef197c1a939c65427592a326782c4b22097af5a9ff48c44191d77b20f223b399e44bd79bc454c8e726f3424a245f05792d10d50aff4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
306976cfb8bd8d499f90c32f727740f3

SHA1
9f1d3ef2e6c7b823783ecc2d79aac071bf6ee22e

SHA256
ab4955d44a77462bd9fa6e49adba62944331398a7f7655a124f9d3ceb6da59c4

SHA512
90f16066f3bd20f5587ea2c8b5782c04b5e3c9d48e278623932207de8d34736c566eb65725886ff07b95ed90372ed2b8e0406c44024998aad0252b5d869e7d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13c4aca328433da61411643d09bbb60e

SHA1
7ce5e3e16d09f222cdd55023b90996c5e65b6660

SHA256
cd1b7f38d0e290ff8dfb19a70a2cbfcaef2db1526528f95d3b4d439c9f3899af

SHA512
9b3cf24b4b608876a72b640f3420424074ce27402128656cb41dce5f8263d07a89c781a77298393623559767c4c7871f70581968b5478c980719969a1bd360bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541a5373e25dea5d4b762c3379604eb6

SHA1
fa60a32331def3ddb4ae1a4017e8b28f444f4c04

SHA256
01ffe42aea0a035fc77618c0b7c35c6c2112d0179fc2cdcdc3890a37a619ecb2

SHA512
cd2997776462dc14a97e81bd63e9313bd79bf9ef67513827018214fc79d5eaa466f1273ea8c489b4dfcc98bbe6dff7ab4deade6674d25190572e75c609cb84c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a86e51b2b759d84e6348044fc4564f3

SHA1
3447d3ed2acd42359c9cfada65ee2da361ee3ba6

SHA256
7d952b0741929fa65c4fd2006435e31b324c72a2cb821aa067c9cc3ef7c6f750

SHA512
25d8f93a76e8fe5e1b11f338ab1ff9490da2f133169acdc930bc9bd76124fa1a3587db361159d0197dd0ab4500f9b31a34075dd7a8b47a1045addb16b569c1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEEB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF45.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit