7d7dd94a9b8a5adabe70813c8a61ad784ca6b586600454e7154ff02a4e423373

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQ手动精灵 V1.8/sdjl_nav.html
Size

9KB
MD5

7e4290e1b166f6fe46aff9bc513c9297
SHA1

338c9a68dd7e3c8d8b157007ff5c581d2aea8260
SHA256

21b38a1e69d51bf51600b229919931689711efe4aa07ad7622fb9f2e1baf1a49
SHA512

cbb1a0dd34f9cee6a4938b6350834cffa1e51f2d6b5f3b3d5ad73b02e3df7940734e71cadf7b0cfe61bd4fbf88534cc23edc8541df34fe7ff9a84f85b0deab33
SSDEEP

192:I5kCtXHjYGCAyXEdjj3ZOuImr09eoDjbMm09:OkChjYGCCjj3IuImZ2b89

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417706458"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004df82a4780da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000bd934acdd12d8540c88d93029ea9051551e59bd2003fa55107e480eaa5d3ee27000000000e8000000002000020000000ac7201a484d0cdac9cee4e77fd5f7b3d00bcd618b6d65d5a7d286fef1379b827900000009525ac9d5cd0821fea29c85fec206efbd40a5beb5ae2a6a05021db7e726ca9e131681e61de7538511afa8eef2f5628fc74bf0f22ddfb4dcaf670a2e3cce583f4ef4594c02ebcb61ca3a691d53511d5bb85aa577acf9679e0babb745727e704144d116f420cc7be53d9e98c93e22081e0c177048aba18171dbf91a61e514bb1cb640cccee2e9c75c51fb6479197fcaace40000000d1222caf48bce94a4ad89de2569a515e57c28e575c47a51a3b490a5e3941011703cd5e8e32522b7179ab17485adcdcae495afa2add05d5135d6f7eb6cf4ce4b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5620E231-EC3A-11EE-9D31-EA483E0BCDAF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000f5dd39c3e3279d9aa5f9920f29f52c0bc60897ca36286dd6bebf03be9559b886000000000e8000000002000020000000ac5c1949d0530473317b27fc0ca0b9d980bc7fe0de41a294048e40304a1b7385200000004f7bab3fde44cbf07475c3630194c3ab6d2eeab8f5223f59c9bbf397b32f619840000000a6f75785a62619cce658001da5b4b3516dad1f0de0691e4c2a574a97f24ac391c5e0aced509eeef8eeb60ce4ba64b1b252887f14e8973d6e983e94621406c396	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3056	1988	iexplore.exe	28
PID 1988 wrote to memory of 3056	1988	iexplore.exe	28
PID 1988 wrote to memory of 3056	1988	iexplore.exe	28
PID 1988 wrote to memory of 3056	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\QQ手动精灵 V1.8\sdjl_nav.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bce4fdab51c1e2bc7244a82cd121228

SHA1
6c8f116e3280b6419fac271565dd077ed9f299d7

SHA256
aca49aaaa1b42890be9529625d5bb5e2b0d2c5b7848304cbf7efde945bae9fda

SHA512
afaec3e3e4342e3cecf927b4e3903ba44627c72d6322f5bee2f2c1c147d4b446338ddafbb37089fd3d4377f629efa6feec6c0969430d32805729a20f7a5d76a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c796077a6c3b810f93b37b9a4b94080

SHA1
44725d217862170394a5a9dbda871da0f6863314

SHA256
6772f73404d1deb8a09bec7d1fda7f3c9087c813688378efa0c6c3a3ccacaa04

SHA512
f2c0bfbeac7039dfdeab407b1fce1cae6ca0276b9a69dfdf9cce838481ceef41f8dc771c7c820db629f0f688c69dfdb6c95f35545987ed44b2f495c334dd1119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10d0fb1b371c44f652ae64c960b73966

SHA1
0e02ed144c6b8e5d828e9b35591f77fbd076125a

SHA256
6bf33168e4ee9032d4cd04d16869ebfc277fad2314a84e90024add8e3499ea7f

SHA512
3778bae46fd4c49728dd645e26aa0645f2a43287a82025d7de1f255f84d5bf9b07aff29868f25432c22750fd7e91318e98d100aa60ebecf85ebd855ba17d3b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36db2da96a9c719180bc37350f29127

SHA1
3af287f893dbe90e2801a80794207ff1916b5b57

SHA256
8374c0cccb4afe40d97e4dba3dc9d0fc84db44529802183b66f145b5b639925b

SHA512
396e4f887adfce1e06be20cb0801fd7c220c5b222575f509639da0be60fd924d35454b512a01bc62f7bf46625a94a17a3b904a7ebc85c8f40a02e251c53a5850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
602d9fed77eff2fcbdd3bc6a45867fe0

SHA1
dd68e47b0f406295506507874a4391cc57e82781

SHA256
4f59061935760de3f815906ae3f38ba8060e7c125ee618a26b65e0aabd1a879d

SHA512
45b1e5594c8fa6b77eb695804501c46493781225364c0130aa81fd4ebd5c552fbd2a7dca1a8e4a43840eb0c8c7afb7e3ef6feb684720f458dd2e4bfdc7f902c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5073.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar53C5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit