2bafd290e0b508efe1cda6683c9f576a755f1b18138dd16a51dd4e0515830c8a

Analysis

max time kernel
139s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

更多下载.html
Size

410B
MD5

7bb7ae902ffeb8c37fe00b88fe68c1e7
SHA1

c839f12d71b57aafbdbd7bca481e9438e8801579
SHA256

8d518dfe520c4464fe9fd28724ae8d9700ab0a6e5a648f9be8a85a526b095c87
SHA512

46ccd91f2d826b19b272c1440b5f8ef7c96261e0ed8cc40d064a0ddc547400e8c35831280999ab37fb7df2a525c8c88d1d5f3e36161b0b633249c7f226b66803

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608e088d4ca8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004da77fb2d69f099b1a4c685895e5e67599381356bd139c3792bb6c672f2b3384000000000e800000000200002000000054d9b63402bf6a78d3193f80ab217887007749339331ff2584e7bc820ee7c5b320000000c607226da2720485491ce959731c18c195f3150767b5bec4cbea7351ba61125e40000000ac0e9a93026e1fac2aaaf92e5b64417337ce9e639651cd041afe9445e6aa58b78942a30ba370ff26667a8c4c74fd73aedff3a63f8ba18b796970f9690f7fbccb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422106810"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B82DE771-143F-11EF-A336-7EEA931DE775} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002e0088b7a6e2c5a6936a40829331bea4e7a1a066d57c2f40f674b9f858717bf0000000000e8000000002000020000000ba3388acb0b1a5efab40280089db776c34a4be490e8594ee835cb2261e845843900000009a44f462fef0b50fd5ef8254763c529e0a8a74d2d96dcd325f0ca517399a155102d74af7e758f8ee46dabea9c70b0eb9492eda32c65dc88d1f639b357f5d9d569a9cb23268a4a53b4afda44fc9cd9de518581033a6e35b4d742236352aa18fcc43784539f07096bc8ed53c050f60fd2d9bc827f13fbb8926efbcd95c3542277bea65a4012b20545d4a7b91d1104e3cfd4000000087bb3e2a5a3b85bf0246c5d94fd7ded951e608f0726bab7d92763b27bac307fe1dbd9cac86cdfb59260137fbaf54c3500ca95ea40226957f3dfe9a4f962958e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1940	2184	iexplore.exe	28
PID 2184 wrote to memory of 1940	2184	iexplore.exe	28
PID 2184 wrote to memory of 1940	2184	iexplore.exe	28
PID 2184 wrote to memory of 1940	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\更多下载.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec518ab9aeb8833640ecaaa043ae2c80

SHA1
4a35cd5551e142fb689fcc73f201f1ae8f76ac20

SHA256
8cc259d67ea5ad5a3637426808cbcdc14fb42ed7a8e9c52e84d53afc3ec5af51

SHA512
a6dfe325d68f1922929aa78a339fc89b3e3c6f419024cad1df5f8d742d7015d070a40ce3c8ee898bb18880b781afae41e83db697757a64783ca69572ba5ce5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a159c59c46e81051e5e42f4089034c

SHA1
f5a3c4a888e28c8ca74d15b13189922b18b44bfd

SHA256
69282b4edc654baf9b4741890baa982031c05cf806355c92fed3142ce445a831

SHA512
ee07c894d33376aeffe4ab07c336ec3d88faa09c8a6346e11395e9907f54ece563bfd6f06e56da3227371d4504509ee2faf18d4d26c188c13fb37a0d51a384d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d231d80705634295d756494e2a5dce31

SHA1
c9f4b053a67adec28784c3c23bc3126d5da45ce4

SHA256
ba3811cc430b6030a66994479d218ffe40a12e4515b28484aba764b02f9b4a9e

SHA512
b23cb4a4f4e412fab6ef976e5dbfc4eff8a8cd65878b0d612b6b228b218f38e610b058efc64e526d0e45dfa49d5afddc02ca50f23057221f53f833d42848bf0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a391f81dc30f513d614e2e7b791b6a

SHA1
06186a44956200e8dfa2253e2d033881a559628b

SHA256
18a4cd85d6f93cd82b8b846f8122ae51a3de6bf89f4acd09c2d6318a293b86a9

SHA512
599d8e701e5430b3d0af50082a5f6b12c100526255314a7adedbb6bc50111e18e46a828236c7131bd498646461210452a9814d4ae2211940137624bfcc41ea65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be25afce2e031440da8eee3a9d51e1d5

SHA1
3e8ba8ebdec6679de523974d21e08e09f8236930

SHA256
fe0021dd4387d83a8b9d7e74ba92af3d57be4eab012b7a3c4ee37b3f2c300d8b

SHA512
588b6aa135c5f3014296d1530bff5eeeffbe8a7f3573be7b3e17fc336916dec9fbb6c5ec23fab058982150a5325cb71729f28064d3689b859918b55816e12d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f5be7d2eba8ff2a7b9e8bcc917decb

SHA1
88799774d266b691330f6dd062127e1367d929aa

SHA256
193313529eff22c1a33691dc792150b05ca4cf34d7e1e5596bfb97a8b5b0b38a

SHA512
aa1997985be810595f2f3c1b5b68c5944aee9b71d935e9e86e1cc36c231ef9d2a7599a559ac6b9b1a0699ffa272b5767ebc48063579409c128a57227de2c239a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8780c4a9cce0a509b9951dab4d5e9001

SHA1
8ceb8f9f05b37cf768ff25da0d9e0e7271d395e6

SHA256
f38c72155c5a9cc03b359ca8c6262aa45caf7901e9175c72cbc4322d32f2b173

SHA512
cb01f63556b908a831e6c7ece99b73b969799ae8d7fd83b73adfbd66cf1ba358ad57c262826e4c1e6fd52f5a68e832cf0b1a3dd458c18ab0d68f282663b5f5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d80472107bb218808ee00a3ce17fb05a

SHA1
834464ecd5804d6e90e431bebf1d4bffd923b8dc

SHA256
ac64613049ed90b922cfeba89e2237a4a7376c84d37fc9caba2bd3ba5446f3bc

SHA512
65e7a11e07fb9eb8e3eb91a2c58922bdefe110927384636a29e4d7e3261c1f53cdd253fbe419edfd2814321a7ef036d49bbc7add27802a66b21dae344124823b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbc2497c7dbbca6c39145e3d490e788b

SHA1
f0da41490fd79f62ddf3b2cc086fcc128546ea33

SHA256
2a6abb2637ef792b5284b25dd6fc6c7477c341b4ead27957a374e7415b5034a4

SHA512
831876555316445b30b75e31d6ce061b4ef98a1ae0acc12d110aa88af8c2dddddcfa28c658f9f135354184ac64064e0c40dbe1414c3970132b32ac2d07b3315f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69e3fd8c515301e6e5f79d3a5103265b

SHA1
8996907bb50004c0d9cc5a6838336b312a0a2134

SHA256
54385ccd71af2ddab94682a2e34e5e295f25616134e1fca4fb7f3dc2d6ac69a4

SHA512
4df7344a3dd1d2fbfaa10d4fb06177232092a3e10e44da79242ecb22681e41379577ce0b44feb37113bb8a026288052cc9bc52e4d86654278a6452e6590dc66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a6ff2b43a66a3d5186a531d6b74d89f

SHA1
ba5e423b63baa02ed7580cc0d939513dc9e6e9df

SHA256
5977f1762d47693d54875530215645dc5697a9ee5fbf10dd3bc31c57a36da92a

SHA512
cbe3a17520f92bc7b14f1f08208e227ffa7626bda863786364c24e9515cc8bab4b3e53aeb09880244e45dac161dc954c9d0283fe37a8e5bd828c97b36b826ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27286335db58b94d00c01b9192d0c44c

SHA1
f232509502cc88b1ca20f2588fd16253896378de

SHA256
b1f4d24c39f9805fe4c3fcbc81e8f29979f6bfd47342eb691a50df1df4c91784

SHA512
393c47277946d60312e5318d2f19d6f4677df3dae0e1e0ebeec86ee1771f5cbd9fb50418845e640ab46cdfc73d0b47dc40dcf274b43855a688968b5045383e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d713e974661f2a5958cd6ab9934249d7

SHA1
960c8c01e21b61873739fd700e5f24140747b068

SHA256
d6c7cadcb1fe1d4ba909d5e70c0080b4a0db5dad741ba7dfdb1b42233289e916

SHA512
090c898d9d872a21975c074e30e64c74e77bb0c5bc50fcf66b3f1cf0184454f8f1361c264e8d8c225c7c40ddf0f04e7f27720e0d08fca4cc0b01cd82452f4f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA160.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA261.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit