1c9e58e71c0e398c9e0cd687762d3df30a5c33743d9064794f5cffb3895674c8

Analysis

max time kernel
140s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

网愿科技-人才网 v2.1 Build 1228/admin/Error.htm
Size

3KB
MD5

97a0517384971ce46d865223461772b2
SHA1

8a9b9e5a128687efd5e77c31e479ab29b15104f2
SHA256

23ec4afc793fc40a1954333473fca66d7b4fad984621bd1e04d10c9851d0ce3b
SHA512

34b2d6443229159fff64e260bc3bfd7bb2f9c6559ce2c88b58d1e1bc10f2be0727f28c7f8f8d36015ade3b6afe7dbdbc0c4287517ca604eaf56addc6f1b998d2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ea65fe2d44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a257a97821c715c1e508539733582b2baea79e7a6aa01fd5c3ae49cadb8eb6ef000000000e80000000020000200000003f6da3dd1cc64222a5b085fd7ab023bd8da82b5cdb521f9102ccf67597764a4820000000adfd6199e19e049902e7b3b145f9992adf3bf9831c3ae365ef82626d2a08e456400000000b00b73f30486684313bafbbecbffc9720f4e9310e260ccc0a975b20c68c40c279e6f56754be53904d67f6d7ee3dca33f38f2684abc48252794a01680a33d459	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24C09410-B021-11EE-A628-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411098573"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000008f6c7efdcf0979a5947b78dfc782f0197d37c556ed0ddae5c54d053b6a514cb000000000e80000000020000200000006590e84916a06eca442e4a35e9e8feaf7e29e340fa430d387ca8f6cca55d3e8f90000000824fcc2bbb0624c579145b034f205c6d241fcaeefb084da28b8c9c5519adb6d10e6904f0c67b053525d3b31a0581d6159399c8f4bc8ac75539758f795fb05b20852d20e33e9048155f5d5c105ee10a0c5716c02e6440fa1d7e6e48f7be5a38630cdfee9f4f3c8db2b9e6fd39c45740c4a9632af548e880bf994e62ff47459680a3bc6f2db07c5284ffe98768f117f7f2400000003687482694a0c0140c7b4a8bbb99d805ae1961897e5d19083166cd664d7c444a8f8e37d7b22da2c1d4a0588a5894c1427a501b9c2cceccfe563792740c90d732	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1960	3036	iexplore.exe	30
PID 3036 wrote to memory of 1960	3036	iexplore.exe	30
PID 3036 wrote to memory of 1960	3036	iexplore.exe	30
PID 3036 wrote to memory of 1960	3036	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\网愿科技-人才网 v2.1 Build 1228\admin\Error.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57c5b08e864d365f6f4d9ab079b03301

SHA1
b790640dfe956e6049b0fe1ff8d5f280cade05ee

SHA256
922d99d536caa9643621edbb84b32f26671c5b560cac73ef1968b275631b9b6f

SHA512
bae037dc195d74106b042832488ad3e15a6f041d02732b515af093ab29e65e213df0ad12402e3d77ee815507f5a6966051080b1e4992e11856b6c3d02cb58ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89676dd8226a5d1783638bedf0f17810

SHA1
b41b80b6c7947f2d631dfacb5b3cb0137e49c8d4

SHA256
24d1d34e71007deeb89797a9a146c8461bd22f8599773b52bf633ffdfee3a9fe

SHA512
25b39be740ba8ccba874bfbb5f78fef2f0f7e0b6db95fc9d40719abf013be3a90b77f594b0440a22afdb5e69be78d57b1b2560f2769cc6322b3282d8216e2e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69809ab16569a77a13a45d3ea52a244b

SHA1
29f8ee8775aaacc67f6efda7938b12639c4c9a7f

SHA256
6d02f186896edb90bf7d3306c229ce569635479d5a2f466485dfb099f76d4b12

SHA512
4bbdc99f504231835259fbbd0afab7d72ab7f64aa11b6a1ff017213b4db312b3e1f6d016f84884da4f97f3da1f1a6f702017234dcf02bcedd70a6b355fc0e0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93cadb2f2c8146eceb45f0b1af421a0b

SHA1
a1673d6b6993d24c9708942097a2210a366d9244

SHA256
7a998de8629220524577ef95489580b12961a962273a0e6de659ade87c46249d

SHA512
aadfa6facee6c54e7297e4cab63d433a3640b8c76f758c22a7fbe8c4e0fae4c69102c176be47173b8262cb5c4e08be6e63d82e75a9aca1d180b5fa7f37673f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a81b6551e033561936a1792b09ef567c

SHA1
0fa7827bee1e7ee0932ae73c81abd2fdd8279ca7

SHA256
2c45dc46ee727182b6dd6efe58acfa03f09277b122bd3548f7d002790c2f82ae

SHA512
1f9a46d4ed41e31913382aa300cd260ecbcc3d6ea50484a17b3795202d7bca8f808c35d61ab564f54cd7ae4949a33234c9b39a135dc209cf893914eef446257c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f401064ad6482eda8f502dd151e583b7

SHA1
bd4c3296003e31d2ccfc50c0dae7dc120110a161

SHA256
8246851005af9a2e6a04d6bca3ec45a404726361b5f7b7079239ca9c96a8adf8

SHA512
9a8a758ecafa11cd1a4fe7069df38c69e7068ce2aef707ed81091e7248b1268c4a2531195ad37911f8276bfdc25f7010d9ea6a52c0eeb183d507e8979b86f442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b5e02dd7508f33b3211e4af0100197

SHA1
ef11887a8cbb0acb2bb183b5d006c3cd67e3a74d

SHA256
5671c1db5363ec40cd6865982313c1deeb4e7c439beff23cc1d963d322bd4edb

SHA512
0ff09ec5f9cde2e4ff6587ecb2e6b7fdcc1ddcf5a9e0db572ad4196ea106cedac20acd588c9b76452fe37a09fd5f1c60d1dcdcada04bdecbcca16e9f829c4bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ec4db5c3328f12bae4d660afe4fd6b

SHA1
4441e163a6c842217536e40364faf289d6515c14

SHA256
a8c77a0fa0205105e29d69454f167eed05d95d02291c75f8e1dcd1ad7093cd1a

SHA512
294a28bafc7933bbc47d0ab628f67718d783375ddac4e96aaf092a48c8e265e09d222cef9f465fecf41a2a40cde638550830a13b9f6268897b6a71947aff1467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aca33be5b8c79e3f7b4a44135a70cf9c

SHA1
f8cb1e0273d841e9e2a9c138957e00829937cab2

SHA256
08f798245542ee7d1617c60453738aabbc9e5f69418ca78a23edc76ddc8c849a

SHA512
b899c9262e3e2189a490c5c1d70f50c5962d7baad9c3ecc470cfb17889aa3a3f01ded5d958b12015ffb22a6d473ebe0aed31375cbabe658b902aece61a96a8d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8961034872d129333e4211d354dc246f

SHA1
8769bf2e16563de5359b10fc8a275b671cb7f17b

SHA256
b5845037d8ca0bcc5ab6ae5f0585ae59868affaccc8460ed0ef944234e65bf1d

SHA512
ad901ff6836cc4bdd89465813b96fb43be5674112a2c89b0d550b355b031852c8dc55f864315c0d1be44aa045d70367bd775d57ae9c6f2521306e5cea811e31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fd11c11cf62b771a1b503cb9f16c5cc

SHA1
b3c580f658ba0ffc9d4d8a94a347709f490c8e08

SHA256
43f59473c2b3a0d0324d24db8bd9fd9a9c28c2be48b99a58376fcd8340ecfaea

SHA512
2ee5f4868924cc6d0056230648a6f89e7c5951c6bf6373625d2ec26f294b905ace0f707e0f1613eb9e328bab919a4f95abdc5037b680ce84e90b3f5d42e2a106

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82CF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit