Overview
overview
3Static
static
1网愿科�...n1.asp
windows7-x64
3网愿科�...n1.asp
windows10-2004-x64
3网愿科�...or.htm
windows7-x64
1网愿科�...or.htm
windows10-2004-x64
1网愿科�...de.vbs
windows7-x64
1网愿科�...de.vbs
windows10-2004-x64
1网愿科�...ut.asp
windows7-x64
3网愿科�...ut.asp
windows10-2004-x64
3网愿科�...us.asp
windows7-x64
3网愿科�...us.asp
windows10-2004-x64
3网愿科�...S/1.js
windows7-x64
1网愿科�...S/1.js
windows10-2004-x64
1网愿科�...S/2.js
windows7-x64
1网愿科�...S/2.js
windows10-2004-x64
1网愿科�...123.js
windows7-x64
1网愿科�...123.js
windows10-2004-x64
1网愿科�...ad.vbs
windows7-x64
1网愿科�...ad.vbs
windows10-2004-x64
1网愿科�...ad.vbs
windows7-x64
1网愿科�...ad.vbs
windows10-2004-x64
1网愿科�...ni.vbs
windows7-x64
1网愿科�...ni.vbs
windows10-2004-x64
1网愿科�...ll.vbs
windows7-x64
1网愿科�...ll.vbs
windows10-2004-x64
1网愿科�...ta.asp
windows7-x64
3网愿科�...ta.asp
windows10-2004-x64
3网愿科�...te.vbs
windows7-x64
1网愿科�...te.vbs
windows10-2004-x64
1网愿科�...ob.vbs
windows7-x64
1网愿科�...ob.vbs
windows10-2004-x64
1网愿科�...or.htm
windows7-x64
1网愿科�...or.htm
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
网愿科技-人才网 v2.1 Build 1228/Databackup/school_wishcn1.asp
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
网愿科技-人才网 v2.1 Build 1228/Databackup/school_wishcn1.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
网愿科技-人才网 v2.1 Build 1228/Error.htm
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
网愿科技-人才网 v2.1 Build 1228/Error.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
网愿科技-人才网 v2.1 Build 1228/GetCode.vbs
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
网愿科技-人才网 v2.1 Build 1228/GetCode.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
网愿科技-人才网 v2.1 Build 1228/about.asp
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
网愿科技-人才网 v2.1 Build 1228/about.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
网愿科技-人才网 v2.1 Build 1228/aboutus.asp
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
网愿科技-人才网 v2.1 Build 1228/aboutus.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/1.js
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/1.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/2.js
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/2.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/2123.js
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
网愿科技-人才网 v2.1 Build 1228/ad/JS/2123.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
网愿科技-人才网 v2.1 Build 1228/ad/ad.vbs
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
网愿科技-人才网 v2.1 Build 1228/ad/ad.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
网愿科技-人才网 v2.1 Build 1228/ad/ad_openad.vbs
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
网愿科技-人才网 v2.1 Build 1228/ad/ad_openad.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_kaoni.vbs
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_kaoni.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_kaoni_all.vbs
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_kaoni_all.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_updata.asp
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Admin_updata.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Company_job_update.vbs
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Company_job_update.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Company_update_job.vbs
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Company_update_job.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Error.htm
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
网愿科技-人才网 v2.1 Build 1228/admin/Error.htm
Resource
win10v2004-20231215-en
General
-
Target
网愿科技-人才网 v2.1 Build 1228/Error.htm
-
Size
3KB
-
MD5
75a3a2af4cfa1269040a7726651c7bfe
-
SHA1
d0c16f5f95fc93ec8b8197178e3335e9ad2e7629
-
SHA256
f7b66cae0916fd949685d24ac2be45220d59bf35078b9891a1d814eb36e2f0e5
-
SHA512
6a2e9f148e136d4a2a4d9a9a8070b6f9e55c67a851eeebb8d2de73cd73383138c765d9386b4807bbdff26ca735a84568a099c4a0314ffa537161091b9478ab17
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000470abb3ae8ef241cfb36c21c225b22e788ffcb768af246f06556c4e332fec99f000000000e8000000002000020000000d74d751a44f76d22201f7152cb094093e6a3c780da19ebcfcbf0003466f086582000000098e99326b6427d2d2ba32ec6ba0b4f89cfc0eb30b449f203b48c3f4cae4a38c3400000004108d42cc5846bd7ba82215e2a89265f06fc964762730e64218dbe5ea63a9e3967974f51427695a9ec0532f18133c7855ef39d2d836466fa8bbc68b6a6aaebde iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ae7a261476acf0204b470e7885d6606e949c097a958fc4c9ed88fbbc1d5e14f1000000000e8000000002000020000000a625ab2d31fb905d8d146c4a0e2e605285e7666b59ad1fa05cbed586bfc4db6c90000000d26f616c703625b95e9ac027da1f905c29ffa15957eb4b1aa83b599a16ed146edfa4bd1b1190d725cf7e179cc842054127655d910e4b310ff4f015b41b1de17662daed54bc33410e47cf72b5bfa4528a862d64c4f667628c73dfbcda9a4bbef4d2dc47a65b4b0caeceae0cd3dc556d2627439f317afd8da4621e5df5d6389a2cc1b200b6ab5b019e002410bdeb93bde7400000009c92a5412807fe12b35f09f2be5e6c23e5157e7aa2f9a01bd7e3bf98df8d0c11da26327a03e2702abb17cb647bd604b79aa9f9fb446576345b492eeec4f57d72 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F87A6161-B020-11EE-8568-DED0D00124D2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bc3ad32d44da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411098503" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2772 iexplore.exe 2772 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2592 2772 iexplore.exe 30 PID 2772 wrote to memory of 2592 2772 iexplore.exe 30 PID 2772 wrote to memory of 2592 2772 iexplore.exe 30 PID 2772 wrote to memory of 2592 2772 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\网愿科技-人才网 v2.1 Build 1228\Error.htm"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b801911ec87738f05556ce30b81d63
SHA11b5a00ca4230816a5103c04287bda497a7414e72
SHA2560d8b8820c15cf5245f9926a62949c72a71d1a8539018faea532774e09aed8ac9
SHA512d272b55f66a8595fa6a1cdfa34c825e2ce0450d60fbc1faa17e108214086c5930face87f12e83debf050a3a6704bb87499de6d23c8655e9080bcd4127819c2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587ebe920e3a62ec677838dfefe26a521
SHA12a247fb5e43ee42857d89a17e8bdf00369261abf
SHA256eb5a8169e5f1083318790a60fa9020fafeb0a338c2042acc958034bb89d7cb1a
SHA512335de244e42a7c1598573e77652c73dff99d8e3a41de1128ffe94e71bd1cb87231c02dafdbbf91d4150d1ad759a10f99087ef866a377ccf9b0a5ece735b3ebd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a6c6d460ae51444f41e823fea7a8e85
SHA1d90e96e9f6a4ce88463a70785a5a7949ce7ce28a
SHA25678424cf89b63d7f88910953495d2f18f5b3d0cc7da500c707e0c6a38b0f9b155
SHA512ff7d4e5ceb55829243e8fb887232b86ca135fd0f782ed453cee49765e387f6588387cde6cf7fcdf2ba4104c92c995eb9c6064f630ed34ec06a2aac2b762af6ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53159c8aa19053dd38d17c4b2dd6875e6
SHA10d411b172ae968e9945cb86170f7948b07ab58ce
SHA2564fc3c0f6f7230fd27627619f9e654a03acf4442b03fcd0a228fc0ac94d992342
SHA512d7eac3c41761c2d6bc5c79338bc19558242e84120ba7dd27ad3ab45d0d33db48b1f71b500e49fd976a3102e16f08300b74ca022803ec10757fc8be2ebfe0d4de
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06