dc1ebbb7b12eb3505b1cb173e77fc802a7f064946673d1c06a9e53d1be8e1fab

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

极速下载.html
Size

110KB
MD5

0c0aa13b9c176498fd24a1fac0f7b815
SHA1

b62a46ec50e743d3b6e15b5763bf0424da3aa21a
SHA256

df24fb785f8ba01c135b1589536ef815a052fe386da40bd2fcaaa086e81ef3f2
SHA512

0214e1ff3046809f0b4f82a68216dd703105db23d2dc21f1082f79fd2681d6fbd8ed4291272717566e1ada87e489fef18c7da79d607e4584708f6ded40b16f98
SSDEEP

1536:5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:5yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470891"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C27B331-178F-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000abcec900aa32c6cba9d397c5bde384186b209d00cf440a36c49bff3b2cdcb712000000000e80000000020000200000003b805614299782834b7c9d6019103589075654ddcb04bba6f7d5ab9e3205be34200000006f27791723afc5be4d93440f6f9f3fcdfa539827e217db9cfa2114d93b06ccad40000000436f178c1d524337cccba3d348faa703e591a76a6bafb22cd3952e53675024388db0c27240ba4b557f774095a20e9d7086be33a6aee9de3257251a8051fc33fe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004093c852284ca02d22462384d393702468e76b70404cfc0359f18902767b335d000000000e800000000200002000000043e655a737af8f90db26a5136356dbcd8635f31328ad5fdb6f551b2bb8f7721a90000000f8c00fbffdaeebcad84cedab33f95c05da307353315cd5c0ba6228de42c79ddd7ed65954fd3505c82fe087413c90312025b950c913d1407be52146a27d2c77c301af5eddc5b3974e53fc273ae8739a49b9ea6b5de8aeb628310fbe72555ae368272701b58c7571b15482861200146cb09c9383729adf16e90dc9831428e6be11868fd89435771b08e56b87a7c779f45b400000003c408bbf89fb4270fffadc46d714024e7ae9c5887185282a0da91fb14b5a0b7a49e8166b5e31a151e5ab2fc455470401c00378656714f7e0fa5eaba16d5b47e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a3d72f9cabda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1976 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1976 iexplore.exe
1976 iexplore.exe
2028 IEXPLORE.EXE
2028 IEXPLORE.EXE
2028 IEXPLORE.EXE
2028 IEXPLORE.EXE

pid	process
1976	iexplore.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1976 wrote to memory of 2028	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 2028	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 2028	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 2028	1976	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\极速下载.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c70818c56ff2dca0100d1b332c5d6fd

SHA1
a940e173ede06880cae15859c81bf4489bd3256e

SHA256
c8ec4a767d09f9e95d623dadf6c151174c5f78e2634c8b66b8362d6822d045c2

SHA512
d8aee435cef642e4ae53034a45b4443d649460eed8a4094d63f628051c056f292785b28e4113304a2e2bbe16c3dac1a34439ce3d0f2c1f67c70cdd7d079061a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b8272f58434d1dbe72c457534776260

SHA1
3f51825f93f9c21deb8164bf8d02110e5cd14963

SHA256
476fd281e3c0d1ddc260249d66e25ceac670b5badad1f2db9dad4041a2c8a3f2

SHA512
b118678abce4dd653d7128d6ebaf9841701dd10f09f9dc3fce5425740ee456632b299c314bdcae9484781d0f09860d51eb1034282dbf6054fe081f7d2abb6aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
898b8e911a1b62f23a21335b5063a12e

SHA1
143d02803cd2148b9cd323e6eac06c1c0b788607

SHA256
8a16ba68dbe194e48427a95e7449435d99df8f54f9bac9c5252b1c8c2f896f5f

SHA512
132c338b2ef5dd91103282906e0261dc5140035138c4351be3a099eedcbd5584449330518c6af0820ca41d6a76b675b009357e8e92c3b48f1c08bb722d7524e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83cb297fe57c01c3a65f69d7bb5c3ae9

SHA1
1db77f901c0ab7d1733993726184c741a372e182

SHA256
1304d28aea4f990e66720b56a880ef321dc37debe7386ebee41bdbbb0d10b5ce

SHA512
54e47527fdfc6be5c698a46c772c686fdc1899b9a4cd0524667dd3d1584185e70c0955f75984971853f0bd198fc3dec273948e40850c95a442182cf03efdc5f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dba3f324315f0ce2b17876447f7413a

SHA1
4f9b01cd65f63e4999c2fe952b5e19f3651ed9dc

SHA256
85bee37ffb9f80bb1a3f82a9b38a024f8dd634fa3f14856194480de358d6f363

SHA512
56a36afdc664aaad66b96e0f3261d5f4eee5cd58561738eb3509027889bd11dc9e2dfcf525d91925395bde50bd53667db81270dc3208231ab089befc054f96f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d6251de9d1d8c2951c99544b5b4b675

SHA1
fa6b3257a665101806243deda3bab9da510205f7

SHA256
1b4ac08f6cbcfe4eb329746a8bb9f80e04617458d5a06932895bf86507318799

SHA512
b7748e29bdf797d5b84f528c40f8404b95c254c65d829d56f9806c422de23f247def27648bf31abba37bd7111323398ca839bd2371ae8b3f51dc9cf44a547f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a40540695af554c38a14f3baf9ed28

SHA1
fba8efdb7b79a45c273e33c4dc56cda4ee84e4e7

SHA256
07b9e5c9f9b9e24da1f09003c4f6d25bfdaaa845ab7d0b760f741c35cd13cb8c

SHA512
e0a08d5b3390c0899d8290333f87c5f7bcc735774aee762e635a9e2d03d4437bc85ae9ffdbd3fc51d1981d68ce26476dd499016b14f834876874ad2b848a6da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57e7a311cae6a905ca9ac992405d96d

SHA1
3549c8b47b4818d4ba7db035fb3ca1186722b990

SHA256
f566f0df2ef9db54af6a9443c15c2d90bb8c75acfe12a4bd37f3b8a23491c589

SHA512
e7fa2280e859d59d7206bde42c6fd88b84623481553ef984b1a4be7fd31617256dc65d0bb75f1381c021621199f731d38b5e50cacc0b001ebbcf75527840d70c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2321d5816ee228c72bc7887f035ee78e

SHA1
0719453ba99d6cf1b277fb2b1f7f0c911854731f

SHA256
8c2f3066842423bfaa2ef0f6353604ca5f5d250835e41f8fa2135294853b73a5

SHA512
f84b1723dc16e7530cbae6c02d6028c4239d2d97cc26b9ffe7a98b81a508092eb39383e5d5e5d47a4e83a70c870e9d35537783c75654b033834285f4b9436138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53cecaa69b5e8f032c229cb4e91aea39

SHA1
056f08c82a1c94b7c58af252f81a8a8913a39dd4

SHA256
546e04a5b1a62847b775a0a6be38b849e15b9a9394f1a1a493713f4e8ef7da3b

SHA512
61b32df93bd8776de8071eda17ba825015cd64c2f9f885553951b877f820a9d581930a5c414c7f91b1fb0d3e0de697b94106a0bc5cf13db54a960b59ccf513a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4bf566e03ce075fb03a771ee745a46

SHA1
9c413ef6a5e11e24edd54ed8f9206760eb2347ff

SHA256
e896d276e6aba621ac157ecd08c7ea97b8b34445913452c8202a7531914e3cbf

SHA512
390ef763c9918da45a4c09dc5510dc747388cfc909e9c4e716efb4e1df55941de1aa4dd9115505c968d49c2e359ba4a48298500ccae4eadfdd40866098e8681d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4824e399ec9a257d830a38afd890aad

SHA1
74808cea82c4dbbaca52495728bede97e4044d5f

SHA256
38769f213390079fbcef3f1b4d13518fe1a26e9baf53e946d16f430974c33bcb

SHA512
d0b70b01212954f42ca59cd138f72c8a7b9a0462a877e55ff12fc3ad29bc5b388edd21fdf450a9762b64eae0a559eb04a20886984366e5539c26ad529ac73bac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf8c287a4ba8aa0a5d929483d44be5b

SHA1
85919c694422be9509ed58b8852c7d7ba25719b5

SHA256
7692781453b47dd699f154f6349d0d5f48c91af8dcd7a579a642a8081387424e

SHA512
6c2781cca04737168cda9960e3d6ed01cb6a85d952603b9769b22644f7e06faf36dba14e05156a5f51ee51025dca2ca09a0c582b79e7d1510f1d7713922348a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f970c94a7b334adf122ec05f47034041

SHA1
b4cd1c762c2e70212536f33a85163f269dc95e60

SHA256
ddfeb3b065b061a77df0fd220386b890e13a33422af31e3f21481c49b2a30769

SHA512
8ded15428174ca086bd45a2a9db89d2201f3b09dad8f22db4feb0eb0429dee91a47b1656da43d8f3d4ac34a1be1474b2ebf319940cfd03b646c5bb0fb5039adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa2b99f553c4ee9fe1ca0c40a4c5ed8

SHA1
1808c276d3f3ce9831e1d922980651a382bee9c1

SHA256
e96934f2b957310d6e141b768ac7c6eb3ad3834dbc9fcbe24b9622b85a108777

SHA512
c788621be16d95c84b25b31f69923e87d316497573703a2e711a38ed9002e15ba58738d748fde273348f0d10d660445f888ba782035982654dd444c8d75b3b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CC4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4908.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit