77794495b0af9c8574cd93dd1f13a55d944a27b65bf02717be8a83b4c62cc87c

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b40c117cda30f1006f01daab38d0f55.exe
Size 148KB
Sample240214-kwsnvsec5w
SHA256 77794495b0af9c8574cd93dd1f13a55d944a27b65bf02717be8a83b4c62cc87c
MD5 9b40c117cda30f1006f01daab38d0f55
SHA1 8b4365377129bc148240f05b8e244604ba524665
SHA512 008be0d63bb7ec76f696346669de9f5d5599be415424e5d1fa8ec6a588943de4baa793c2cc3685edda0cd212ae5b8f87254d92147587117daf6fb6337142f43a
SSDEEP 3072:yziUjE5x5q4QmiqKxXn/Yg1MxpQAStrvGfmdw:yziUjE32/YgKKntzGt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	9b40c117cda30f1006f01daab38d0f55.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	p5tEgA8fIVA5w88.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1032	p5tEgA8fIVA5w88.exe
4372	script.exe
3188	smss.exe

Loads dropped DLL 1 IoCs

pid	Process
1052	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\XlKankan.dll	xcopy.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\MYShowIeLinkIe6.reg	WScript.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe	p5tEgA8fIVA5w88.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.vbs	p5tEgA8fIVA5w88.exe
File created	C:\Windows\userid.txt	script.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\Script.vbs.bat	script.exe
File created	C:\Windows\tao.ico	p5tEgA8fIVA5w88.exe
File created	C:\Windows\MyShowIeLinkIe7.reg	WScript.exe
File created	C:\Windows\AddRight.reg	WScript.exe
File created	C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe.bat	p5tEgA8fIVA5w88.exe
File created	C:\Windows\ftdyix.vbs	WScript.exe
File opened for modification	C:\Windows\SetWindowsIndex.reg	WScript.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\reg.bat	p5tEgA8fIVA5w88.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\regBHO.reg	p5tEgA8fIVA5w88.exe
File created	C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe	p5tEgA8fIVA5w88.exe
File opened for modification	C:\Windows\SysWOW64	xcopy.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\XlKankan.dll	p5tEgA8fIVA5w88.exe
File created	C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe.bat	p5tEgA8fIVA5w88.exe
File created	C:\Windows\search.reg	WScript.exe
File created	C:\Windows\.reg	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000340000001b000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f000000560000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000030000002003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/index.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\LinksFolderName = "Á´½Ó"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c0000000000000468100000010000000feb8496527bbc90112c0b16e27bbc9015aac066827bbc9010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008c3acb231000444f43554d457e310000440003000400efbe8c3ada218c3acb231400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a003100000000008c3acc23100041444d494e497e310000320003000400efbe8c3acb238c3acc2314000000410064006d0069006e006900730074007200610074006f0072000000180056003100000000008c3ace2311004641564f52497e3100003e0003000400efbe8c3acb238c3ace23140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d313236393300180030003500000000008c3acf231000fe94a56300001c0003000400efbe8c3acc238c3acf2314000000fe94a56300001400000060000000030000a0580000000000000067686f73747870332d3436373638300008fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa208fff6b72738414d8df317a72f9d101cdd0c5a861a27de11b28a8662afbb9fa200000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\SortIndex = "6"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/baidu.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 65cf80b551e1c349b73f70b13fca8e86	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\SearchScopes	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[¹È¸è]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/google.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000030000000140000002a000000010000008006000080010000030000008102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} = 21bf5c0e5fd1d011830100aa005b438322001c000800000006000000010000000000000000000000000000004c0000000114020000000000c00000000000004681000000100000009ed10ec233ecca01e61abf65c5edca019ed10ec233ecca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c00310000000000a53c284a1000444f43554d457e310000440003000400efbea53c1249a73cf1481400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a63c8e0c100041444d494e497e310000320003000400efbea53c284aa73cf14814000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a63c760f11004641564f52497e3100003e0003000400efbea53c284aa73c3344140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a53c294a1000fe94a56300001c0003000400efbea53c294aa73c334414000000fe94a56300001400000060000000030000a0580000000000000068792d3636796c7032363264663675000ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e00026180888870ed24080beba3a40a5d7359938b74ca04778a6832a58df11b1e000261808888700000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\DisplayName = "°Ù¶ÈÒ»ÏÂ£¬Äã¾ÍÖªµÀ"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[ÓÐµÀ]Ñ¡´Ê¿ìËÙËÑË÷\ = "http://www.mylovewebs.com/api/tag/youdao.htm"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\URL = "http://www.mylovewebs.com/api/taobao/so.htm?word={searchTerms}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconURL = "http://www.taobao.com/favicon.ico"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{E140FB5B-2A9D-4FA4-A20F-089B92412200}.ico"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[°Ù¶È]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar\Explorer	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 110000005c00000000000000340000001f0000006200000001000000a0060000a00f000005000000220400002600000002000000a10600006001000004000000a1000000c600000003000000a1020000d4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\URL = "http://www.mylovewebs.com/api/baidu/so.htm?word={searchTerms}"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\FaviconPath = "C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\Services\\search_{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}.ico"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383} = 8145e001ee4ed011bfe900aa005b4383100000000000000001e032f401000000	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{F2CF5485-4E02-4F68-819C-B92DE9277049} = 8554cff2024e684f819cb92de927704922001c000800000006000000010000000000000000000000000000004c0000000114020000000000c000000000000046810000001000000010a155c0ffe9ca0118bf0ffd11edca0118bf0ffd11edca010000000000000000010000000000000000000000000000005b0114001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000005c003100000000008e3ab9151000444f43554d457e310000440003000400efbe8c3ada21a23c2c701400000044006f00630075006d0065006e0074007300200061006e0064002000530065007400740069006e0067007300000018004a00310000000000a53c0586100041444d494e497e310000320003000400efbe8c3acb23a53c058614000000410064006d0069006e006900730074007200610074006f007200000018005600310000000000a23c809611004641564f52497e3100003e0003000400efbea23c0070a23c8096140028004600610076006f00720069007400650073000000407368656c6c33322e646c6c2c2d31323639330018003000350000000000a63ce45d1000fe94a56300001c0003000400efbea23c0070a63ce45d14000000fe94a56300001400000060000000030000a058000000000000007063323031303035303232317663620008fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824608fff6b72738414d8df317a72f9d101c92a9ac9dce58df11a8ce001e65ca824600000000	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2D17A31-2642-4D03-9D1F-ABD3BE1DCC4E}\SortIndex = "2"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E140FB5B-2A9D-4FA4-A20F-089B92412200}\DisplayName = "ÌÔ±¦ËÑË÷"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\MenuExt\Ê¹ÓÃ[×ÛºÏ]Ñ¡´Ê¿ìËÙËÑË÷	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\ITBarLayout = 110000005c00000000000000240000001b0000004a0000000100000020070000a00f00000500000062050000260000000200000021070000a00f00000400000021010000a00f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1026"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.zaodezhu.com/?my=1026"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.zaodezhu.com/?my=1026"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder\ = "00.00.00.00"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\ = "É¾³ý(&D)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command\ = "\"C:\\Windows\\20240214\\JbAM5r8jXb88JXTa\\script\\script.exe\" \"%1\""	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\ = "QvodAdBlocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "AllTypes"	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ProgID\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.ini = "inifile"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\.txt = "txtfile"	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ShellFolder	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\Q\Command\ = "Rundll32.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\Clsid\ = "{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "AllTypes"	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\ = "{352EE19A-DA33-499F-B3B1-7A2DFC87D983}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.xunlei\ = "QvodAdBlocker.xunlei"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ = "_xunlei"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes	script.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllTypes\shell\open\command	script.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\ = "Internet Explorer"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}\Shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&H)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01E9FB1E-8145-4702-B7B3-B687F49F8CDC}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{352EE19A-DA33-499F-B3B1-7A2DFC87D983}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\XlKankan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE02D2D8-63BF-4E08-9922-E58DBCFCFE33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Runs .reg file with regedit 8 IoCs

pid	Process
4216	regedit.exe
416	regedit.exe
3172	regedit.exe
2124	regedit.exe
4892	regedit.exe
1284	regedit.exe
1852	regedit.exe
4544	regedit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3188	smss.exe
3188	smss.exe
3188	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1856	2572	9b40c117cda30f1006f01daab38d0f55.exe	84
PID 2572 wrote to memory of 1856	2572	9b40c117cda30f1006f01daab38d0f55.exe	84
PID 2572 wrote to memory of 1856	2572	9b40c117cda30f1006f01daab38d0f55.exe	84
PID 2572 wrote to memory of 4756	2572	9b40c117cda30f1006f01daab38d0f55.exe	86
PID 2572 wrote to memory of 4756	2572	9b40c117cda30f1006f01daab38d0f55.exe	86
PID 2572 wrote to memory of 4756	2572	9b40c117cda30f1006f01daab38d0f55.exe	86
PID 1856 wrote to memory of 1032	1856	cmd.exe	88
PID 1856 wrote to memory of 1032	1856	cmd.exe	88
PID 1856 wrote to memory of 1032	1856	cmd.exe	88
PID 1032 wrote to memory of 1120	1032	p5tEgA8fIVA5w88.exe	89
PID 1032 wrote to memory of 1120	1032	p5tEgA8fIVA5w88.exe	89
PID 1032 wrote to memory of 1120	1032	p5tEgA8fIVA5w88.exe	89
PID 1120 wrote to memory of 4372	1120	cmd.exe	91
PID 1120 wrote to memory of 4372	1120	cmd.exe	91
PID 1120 wrote to memory of 4372	1120	cmd.exe	91
PID 4372 wrote to memory of 2300	4372	script.exe	92
PID 4372 wrote to memory of 2300	4372	script.exe	92
PID 4372 wrote to memory of 2300	4372	script.exe	92
PID 4372 wrote to memory of 4912	4372	script.exe	94
PID 4372 wrote to memory of 4912	4372	script.exe	94
PID 4372 wrote to memory of 4912	4372	script.exe	94
PID 4912 wrote to memory of 1316	4912	cmd.exe	96
PID 4912 wrote to memory of 1316	4912	cmd.exe	96
PID 4912 wrote to memory of 1316	4912	cmd.exe	96
PID 4912 wrote to memory of 4892	4912	cmd.exe	97
PID 4912 wrote to memory of 4892	4912	cmd.exe	97
PID 4912 wrote to memory of 4892	4912	cmd.exe	97
PID 2300 wrote to memory of 544	2300	cmd.exe	98
PID 2300 wrote to memory of 544	2300	cmd.exe	98
PID 2300 wrote to memory of 544	2300	cmd.exe	98
PID 4912 wrote to memory of 1052	4912	cmd.exe	99
PID 4912 wrote to memory of 1052	4912	cmd.exe	99
PID 4912 wrote to memory of 1052	4912	cmd.exe	99
PID 544 wrote to memory of 4344	544	WScript.exe	101
PID 544 wrote to memory of 4344	544	WScript.exe	101
PID 544 wrote to memory of 4344	544	WScript.exe	101
PID 544 wrote to memory of 1552	544	WScript.exe	103
PID 544 wrote to memory of 1552	544	WScript.exe	103
PID 544 wrote to memory of 1552	544	WScript.exe	103
PID 544 wrote to memory of 1560	544	WScript.exe	105
PID 544 wrote to memory of 1560	544	WScript.exe	105
PID 544 wrote to memory of 1560	544	WScript.exe	105
PID 544 wrote to memory of 2984	544	WScript.exe	107
PID 544 wrote to memory of 2984	544	WScript.exe	107
PID 544 wrote to memory of 2984	544	WScript.exe	107
PID 544 wrote to memory of 2800	544	WScript.exe	109
PID 544 wrote to memory of 2800	544	WScript.exe	109
PID 544 wrote to memory of 2800	544	WScript.exe	109
PID 544 wrote to memory of 4660	544	WScript.exe	111
PID 544 wrote to memory of 4660	544	WScript.exe	111
PID 544 wrote to memory of 4660	544	WScript.exe	111
PID 544 wrote to memory of 952	544	WScript.exe	113
PID 544 wrote to memory of 952	544	WScript.exe	113
PID 544 wrote to memory of 952	544	WScript.exe	113
PID 544 wrote to memory of 1284	544	WScript.exe	183
PID 544 wrote to memory of 1284	544	WScript.exe	183
PID 544 wrote to memory of 1284	544	WScript.exe	183
PID 544 wrote to memory of 1624	544	WScript.exe	182
PID 544 wrote to memory of 1624	544	WScript.exe	182
PID 544 wrote to memory of 1624	544	WScript.exe	182
PID 544 wrote to memory of 5036	544	WScript.exe	119
PID 544 wrote to memory of 5036	544	WScript.exe	119
PID 544 wrote to memory of 5036	544	WScript.exe	119
PID 544 wrote to memory of 4692	544	WScript.exe	121

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4344	attrib.exe
4692	attrib.exe
1504	attrib.exe
1144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9b40c117cda30f1006f01daab38d0f55.exe
"C:\Users\Admin\AppData\Local\Temp\9b40c117cda30f1006f01daab38d0f55.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe
    "C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe
        
        "C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4372
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20240214\JbAM5r8jXb88JXTa\script\Script.vbs.bat" "
        6⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.vbs"
        7⤵
        Checks computer location settings
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:4344
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrators
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c Administrators:CI
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r Administrator
        8⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r users
        8⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r system
        8⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r everyone
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r user
        8⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Power Users"
        8⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\Internet Explorer.tt" /e /c /r "Admin"
        8⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:4692
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:716
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:1504
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrators
        8⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c Administrators:CI
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r Administrator
        8⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r users
        8⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r system
        8⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r everyone
        8⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r user
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Power Users"
        8⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css" /e /c /r "Admin"
        8⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\attrib.exe
        
        "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" +r +s
        8⤵
        Views/modifies file attributes
        
        PID:1144
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r Administrators
        8⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c Administrators:CI
        8⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r Administrator
        8⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r users
        8⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r system
        8⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r everyone
        8⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r user
        8⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r "Power Users"
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cacls.exe
        
        "C:\Windows\System32\cacls.exe" "C:\Users\Public\Desktop\ÍÅ¹º¹ºÎï.bt" /e /c /r "Admin"
        8⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:1284
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MYShowIeLinkIe6.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:1852
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\MyShowIeLinkIe7.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:4544
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\search.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:4216
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\.reg
        8⤵
        Modifies registry class
        Runs .reg file with regedit
        
        PID:416
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\AddRight.reg
        8⤵
        Modifies Internet Explorer settings
        Runs .reg file with regedit
        
        PID:3172
        
        C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\System32\regedit.exe" /s C:\Windows\SetWindowsIndex.reg
        8⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Runs .reg file with regedit
        
        PID:2124
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\20240214\JbAM5r8jXb88JXTa\script\reg.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /c /q /y /i XlKankan.dll C:\Windows\system32
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Enumerates system info in registry
        
        PID:1316
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regBHO.reg
        7⤵
        Installs/modifies Browser Helper Object
        Runs .reg file with regedit
        
        PID:4892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s XlKankan.dll
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe.bat" "
      4⤵
      PID:1480
    - - C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe
        
        "C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe.bat" "
      4⤵
      PID:2156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9b40c117cda30f1006f01daab38d0f55.exe.bat" "
  2⤵
  PID:4756

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9b40c117cda30f1006f01daab38d0f55.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\9b40c117cda30f1006f01daab38d0f55.exe.bat
Size 397B
SHA256 d48f253e4736d63e92e524a9eb618b78680a72819a3fc4a6da2b040a16730309
MD5 5ca45c1c2212781a15261b972e8ef229
SHA1 7a992537d340c2330260ea32154547733f981438
SHA512 7bb640b132514a156fe975df2df17518a50b4f37f1385164055deb170f454a9cb1725f2c9579fd35971bd7c0692f4257cef155567cd44a767ae151a439230039
MD5 SHA1 SHA512

Submit Download

p5tEgA8fIVA5w88.exe

Path C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe
Size 112KB
SHA256 b90d8c4189c0d7d19981fc56b7981b813098a067ee29829653001af8dc93385f
MD5 ea30f91149efa0bafdf3824e8909e1a6
SHA1 91bf1e48dd4a71d0ee7fb55584594d3f90eb86b6
SHA512 f6fec138773bd83867bf2c328bf9bb27be7d054fe4ab77f566c9fdede39f0257ccb15b6671ddda2ed80120a8021e87546c33dc1a96933c88631bb86aa81bfcf9
SSDEEP 3072:DgJbCUPxNzAnauTBftdxmxPZk4zPGS+8rARRu:DoUnauTBHxW/TvzWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

p5tEgA8fIVA5w88.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe.bat
Size 329B
SHA256 96292d833f6199a66b06bf4f02f6db5f161ea629a9a4f0dd97ce505d4875792e
MD5 c6802ebc332645ae67ad58e604948e07
SHA1 92a61304955c4bb679c5852927b01858c1e71546
SHA512 677ed7864db268e65bb2701165d499b361e45ec17e7ea4ab8a78769bf56041efbe0432d7194025329332cfa4ab77a752e5b25fa26527d743a2ab584c422fbbdf
MD5 SHA1 SHA512

Submit Download

p5tEgA8fIVA5w88.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\p5tEgA8fIVA5w88.exe.bat
Size 207B
SHA256 7ba35d10046371934e443f903a281ee4be955921597f8ab168db9449d0bc22de
MD5 c93c5579c1021c0fc5b320dc18ace311
SHA1 b1a0e73de60e983089160e6e2bc3485ecdd75831
SHA512 d08b05a8890b09bcef070b48db81e17955130d2d3822137deceddec259e6d2cac9a5fbce71105dbe2df6c470fa4f5b2a25234cdced118d9b515aa0c0fc44f8ae
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Size 2KB
SHA256 fb22ff3c479584d482ad8ec1ac346563022784a58b42e2b0d7968a53fb55c9ef
MD5 47b37a311bda9afb7808ccbce6d4bc7a
SHA1 f140a04635fcc452e7c046c442b2c73d4b652f21
SHA512 08f20ad4be4bfd95bfdc598846fdab389c2f8505a4f83786fe5ae9eaff37d7e2344de6bc3add2cf5065ad135c15dfcf1288d91df05336700d3787ae07afe366a
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk
Size 2KB
SHA256 5b99dd6768d4e697fb88461b6aa612d52e8fbc9d63a77c48f1b04f8bdddb725a
MD5 b9b0155d654885af7103f767de715817
SHA1 cb22bd8c29b5a770d6245c6a82de0f166402f1c7
SHA512 4dc05195564ecb6b36a574c6a9d11ed3c87fab9135b3f0f4bfe371aaa1e4c87f38e00911c8c3ed299501ba7ac0a85ac345f60ea83fc964bc23f41fa3d997a5a1
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 418B
SHA256 1738ed05ed5db19eda56e6fa9905a183310b42c0c628f7eddc94854291ce3be7
MD5 8f48c6d76826e72128aacc7d20f41671
SHA1 a0e7d1c87de71916e5b7d3d07f0090d9dd82319e
SHA512 82469d37093b96ced5aa6d42eef20d5736df0a2f15be4825c8e25b1a8f67b7f1c78875a1a10d4a06e6ae298eaf36f28da36da07c19b9fee4d277f066c3456898
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 400B
SHA256 8ebaf28ec13b784392dfde40be32d87b5fa9ac86a94d7ecf8ed45ed26653b204
MD5 7d794977e64d0b35fc1efd56eab87b44
SHA1 eda0a4475c89743ad07118c12f6cf2c286537b84
SHA512 2be588c5b9267b315c0f8a51bdd26d2dabb385ac1863125b8e454934a944b41764a56f84ab61a317c1899b0cec63b3c38ac4cf5b102b6cb7af4e09bcde4ddf63
MD5 SHA1 SHA512

Submit Download

Internet Explorer.tt

Path C:\Users\Public\Desktop\Internet Explorer.tt
Size 8B
SHA256 044775cb0f1e2b9162c192dcaea0ff0fa1be84bf7bb0e388c8190e237e861a33
MD5 e51f9cdcf7efb98e0859c9f85ce367e2
SHA1 02a5a939959597a5bbadc703fddff668aa98360d
SHA512 0f0028bb11ec79b02424d81891421eae8989faad76a82e8ac7a90bc2522ea97cc3ed163495827d0a4e80f0a0e97b0d7aacc877e070c7a921a948d8b9995ea026
MD5 SHA1 SHA512

Submit Download

.reg

Path C:\Windows\.reg
Size 1KB
SHA256 1fbdaf7773a0ad8e371f2ed40768c2e2e9b3f63436ac1e9f0066b5177913c84a
MD5 75721cb2a7848c3df7b00faf4401b9c9
SHA1 cb4ad243b92b38739b970b98ef31d37ce3d0923d
SHA512 4f1d9c2197be1bd4830cbd942293b614b8ba18956a9af749ac905fc9f17456dcb2962f6c93fa0fdf8209a56443e5799bbf96a491e4d6974cbaee018926045206
MD5 SHA1 SHA512

Submit Download

smss.exe

Path C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe
Size 5.3MB
SHA256 d59f55c1e8baff752d8c865cef39f7287e22e7df96d91d861579d73b82b45f4d
MD5 8d3b0d48f3825276e7f63226413db285
SHA1 c09cac2f7540f8412ff1fd0b6029a10baf012141
SHA512 336c6387d6316b88abd8e05942457e380e2ca5a23c37319c725ae1adbf6624dc52d1051bfa3cf11ad3983246841d950c18457f7749cad0443bbadf638928f7db
SSDEEP 1536:xTTopCn2ZElajwaY80HqkuYRs1eIjyGp+TTortititititititititititititiC:xTTopCFAk/RsZ+TToT
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe
Size 5.2MB
SHA256 25f9b7d70751745a37a736f6e4813e6db3571a2bce30b55ba66bc3bcede808e4
MD5 7e85c2ac52df8fc51c5b4cfe9c93e912
SHA1 6396fba3c2ca75de4c5b5049ae41f2f6dfd236e0
SHA512 e30c912e96d3662c4a2ac048efe96f15ccde1d8d31d7d2234282c11621b0360be35edfef7142b027b8910d3214ec4c774a31dec01d881502d1e0717afe180608
SSDEEP 1536:xTTopCn2ZElajwaY80HqkuYRs1eIjyGp+TTortititititititititititititij:xTTopCFAk/RsZ+TTou
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe.bat

Path C:\Windows\20240214\Cf5aY22uEnNAf8y2\smss.exe.bat
Size 183B
SHA256 6d8d4af981429471b025c32dea3faf58a4e85bb0e15d09e79b09e608544e87bf
MD5 bf3a181b92f7f3c3a71bc62052695cb4
SHA1 1d091da1c3827abaefd94f618d642eee0f374b81
SHA512 c63523f4f6dce334d952231b5a2899ff341c834f6ef657a82eb0605d524f6d4d04ca6f1dab568ac6abb94961f512a315b067f926dfdcaa9bf31e21dec503e3a8
MD5 SHA1 SHA512

Submit Download

Script.vbs.bat

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\Script.vbs.bat
Size 214B
SHA256 4c90dfa0cd500d36186930d8a595e519a159a56a6d9201881187f7b288d938fd
MD5 23d3aeccc8ad2a55b9b298d234593101
SHA1 1fc33886f50ca760bb1b708918d89ed4ef8601c8
SHA512 3f9d3e45f5bb0d07c0766b1e2e6338f2faf199184020e4a053dd153585755ab7cd9a318a854d7dd02ae4f8fce621c46e760ab997a8caabc0f8e12f2961654580
MD5 SHA1 SHA512

Submit Download

XlKankan.dll

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\XlKankan.dll
Size 28KB
SHA256 9e9a8a9522ae2822ff0130a9d7736417d32a85c6c66c44048d8b2d2ec4677466
MD5 ce8f0033298014df0508a996b638b5eb
SHA1 610f52ba70f2053a9a4dba08d88a3f97243aa3d6
SHA512 216dcd79aa7bedd2e9c819978c2477787ce4b2a34f33c64881db21d1ebc96e0b44169d652c68bd4053bcb963a6b1c673d585e44feb6c30ef30121f0076ce3200
SSDEEP 192:F0JBLwBz2hNuW7G9qEZhip63JlU4nTH09A4/6rA5+Gp9YpsQUAuVTopvPZ:4VhNuxjOki4QeQAfpsQeYnZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

reg.bat

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\reg.bat
Size 130B
SHA256 86861d7856b53976d754875343237f55e63ca5580db3e57f6ffbbc86977ef573
MD5 d426a1646ddadd0e41ff5358eeceb3c4
SHA1 69e585d10ad1f4d03a4ceec7f4e336951e10406f
SHA512 401c3aa8a1a426cb7c6fdfc0e0cd5da193abb8c44c17143996e57838060f22601c51fc3a3da915d0ac3a3f7a70a217fa9576c575bc9f5a30b542c9a5a206dd97
MD5 SHA1 SHA512

Submit Download

regBHO.reg

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\regBHO.reg
Size 356B
SHA256 2b6fb4f8615a821498deb27a55261d482fcf97a1dbe8143d233ee7d1b9b63dac
MD5 b93db4ec7eba064cbd7336085953cce9
SHA1 79b458e4b5c974ce2361b103905a941eae0210b9
SHA512 420819a9aeeed54337aaabe2f4cf5f0f6b91cda6bacc5eae496320e2d22cc4eafccef7e38d4085d868ab28177889bcbf025f496c14b5df0384bc93ad14d591a6
MD5 SHA1 SHA512

Submit Download

script.exe

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe
Size 14KB
SHA256 37e91baf0e737219f49bb4beedead82572b7c9c0c1b3b1232b77e7a2e7c40da5
MD5 181b53fa7032009d1e571e60ce740cbb
SHA1 1c2958fd8d4894d1ce7ec23b97a45eeadb20722f
SHA512 c60b9a29df10f63e669fd90686ca104169c3a1318f22ff6148a9bb08a07c0b836c1dab92f6d7c2dc9edc50704f66f0bcd3de704a7a41e52c5ee566efcfb6dd62
SSDEEP 384:smRXIGT1G7n6wxvInBT2XlygVTdv42x1HisF:sm91Guwx02ggVTdv42PHis
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.exe.bat

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.exe.bat
Size 210B
SHA256 31748c5d1daa4a66f449a86408320e316b2ba6d5826cee3a7397fa59c8ac5563
MD5 6c78c4497823e464f2e3e03748b0437f
SHA1 c8aec7030fd2243fea52598c5edfb8c161d215dd
SHA512 8a768f4a9bdd9a14ed6f59877a072576e31429a8c6dca834c4255f61d1dbafd23991547aaeb8e7721f05438dceaed161f98c60aa630a1fc489d8d5f3a6b061c0
MD5 SHA1 SHA512

Submit Download

script.vbs

Path C:\Windows\20240214\JbAM5r8jXb88JXTa\script\script.vbs
Size 74KB
SHA256 b02a1d340606815f766afe59c6c7bd5e73b16954fa0c2f3489a00a49a5ab4f6a
MD5 9ecc1bef464dc50985e94bb61ea39481
SHA1 d322f77e54cc0e7111f4e894cb2bbe9e7afd0ff0
SHA512 ae5bdd6aacb71e9b9b844d8a7fa01ac474c042d931d00cadfc6b51d1aa6346794a4fdb54aa844feed9b8024ac08de2958c7970f53d6bd816edf76c2916d5f2be
SSDEEP 1536:8nik/IHWz3pvtKPSKCEyzKjH/TMRmEUJysgo3:+ftKPSKCEyzKjH/TMRmbJysgo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddRight.reg

Path C:\Windows\AddRight.reg
Size 592B
SHA256 a86cc1150a07bef8f91c426568651eae78be6af0ba06fc067014d6a9fb2c52c2
MD5 53d75aea40be26a09d46f220accfb528
SHA1 82e1a094df1d4137697dfeb9f6b77b877d77ef8a
SHA512 1151e563503ef2841c8a052f0166565238fb86359ac4ded9939e77438e1efccc8d43d767e4dd59502dad4e0b38bf1bda7616254acbeb2b1ac07b2d30b0df3736
MD5 SHA1 SHA512

Submit Download

MYShowIeLinkIe6.reg

Path C:\Windows\MYShowIeLinkIe6.reg
Size 7KB
SHA256 7cd8b741bfaee5cd14779b69d71b362aac4c928097c6b4af8ce0ce16bde52a46
MD5 4f69fa82c34c91514da21a5933644af8
SHA1 e131f57f41ce95b46195d460852718b83517579a
SHA512 276588f960d28023febd87873c7852f401ab6ebfb3d90bf8b21b1998949d8ab00badb42d1a05934587aa6b4ad0ab06a3d649dcdb70f384ca70339049243463c4
SSDEEP 48:9JJj0+jaj59ejl9CGoVZJRAOvoSEFCX68yctVJLCq0u0:PJT+jef7QYOi03FCq0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyShowIeLinkIe7.reg

Path C:\Windows\MyShowIeLinkIe7.reg
Size 9KB
SHA256 71927f4f034db038385346e34209ad069139f54d73bae34bfaf4f29b7010fc6b
MD5 dbd46bf2e72f6dfbb21295f4e3066d47
SHA1 cdd6ca2f6455c1e528c40a520bcdb8669df8f548
SHA512 ad013387a0c7608375b7a3c5fdb27f0d9e79b051d84b1ee9221346499f386d30473b5e2727f6a4e8a8122cf8ac2d473a5ce5e368e62da09441ed48e5c088bd11
SSDEEP 96:PQjGf7Qt9gOkbe5CPSRkPGUfggvpGrTVmF:PSY29lZqg2kTMF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetWindowsIndex.reg

Path C:\Windows\SetWindowsIndex.reg
Size 150B
SHA256 2d13c41a8992321c6be0cec7e4da3fa8cd4711ffa5d5478a98c7e23abb1c7b4c
MD5 3f7aefcd5bf4a3945fd249d8bd39201a
SHA1 51d9e7b51b6032e5dcb5cd3f74b15585160902db
SHA512 a62020ed8fe2343860935f3367d658a7f2e9f5cc63bd7d4186a8a42337f49e979a24db678ca9711d73933a4c5413d1caeb247c68cffa01e4cf1bd2de83894628
MD5 SHA1 SHA512

Submit Download

search.reg

Path C:\Windows\search.reg
Size 1KB
SHA256 ff8d92c2bbe81ccfa1a6ac46ac66e7b42dc4fd18a27924c2e6511d2579f092df
MD5 8e2ec860bfbd9aa37ea44e51d559ea9b
SHA1 f64e2891ec34d4909f28b2ae14c0a9f712a0e29c
SHA512 ad551272a90d79aef258d22680c07a5d81b0b31e1712dc2a60ac2c67f8af13f18c3a5f99f8408231bc5bb4f68882a5d75ed5c0e203059575eea5940d8b841dc1
MD5 SHA1 SHA512

Submit Download

userid.txt

Path C:\Windows\userid.txt
Size 4B
SHA256 582c0168ba17eac49642bc85ae623204069e8d6ea06cf45af11e7de46ea31d18
MD5 24146db4eb48c718b84cae0a0799dcfc
SHA1 183723726a927563ad46963f2138cc147d04cea0
SHA512 cf1c23aa0a43423bb6a89b1a5f9c4cf3109eae58749c527553b07f56446b51ee6cc24dd6020932a33b9e7c5b84c7480b2c890070fa6b75b93d08f38d0c472eb4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads