9704e414d1dbc9a52246488d6ad0ec9da9ee51268dd4b7d5a578aa66aa5c8e7f

General

Target

919084783.exe
Size

666KB
MD5

478c61042cf2e405634cd28465332ce8
SHA1

4468ecfc493930cca285e23eaf87d2da1d7caa94
SHA256

45db9d9d372ec43413597450d7a888e4ae195e7ae12e1fb9709524469e42adba
SHA512

c1568994b6849f1873936eb9baac098e8ef2519794bb8f27d77339a4342df46f7df161a523d0df79ddaf4d9e446dfced9cc7dacb1d1e22d43873920ef7edf01b
SSDEEP

12288:Dgeh+QxEID1Rgf4tQnPkTFhpviFrXsmnztHf5lRpde4acO3qZjXfaGcU9lt/:rhzGIJ5yPYgtXsKfnRX5/O/GcU9l1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2868	Fav~Url.tmp
1624	fbinst.dll

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Favorites\淘宝购物\Desktop.ini	Fav~Url.tmp
File opened for modification	C:\Users\Admin\Favorites\淘宝购物\Desktop.ini	Fav~Url.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dbcOnce\SUPPORT.IM_	fbinst.dll

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	919084783.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.hao123.com.bz"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.hao123.com.bz"	919084783.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2696	PING.EXE
3284	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2868	4608	919084783.exe	85
PID 4608 wrote to memory of 2868	4608	919084783.exe	85
PID 4608 wrote to memory of 2868	4608	919084783.exe	85
PID 4608 wrote to memory of 1524	4608	919084783.exe	86
PID 4608 wrote to memory of 1524	4608	919084783.exe	86
PID 1524 wrote to memory of 1624	1524	cmd.exe	88
PID 1524 wrote to memory of 1624	1524	cmd.exe	88
PID 1524 wrote to memory of 1624	1524	cmd.exe	88
PID 4608 wrote to memory of 4680	4608	919084783.exe	89
PID 4608 wrote to memory of 4680	4608	919084783.exe	89
PID 4680 wrote to memory of 2696	4680	cmd.exe	91
PID 4680 wrote to memory of 2696	4680	cmd.exe	91
PID 4608 wrote to memory of 2340	4608	919084783.exe	110
PID 4608 wrote to memory of 2340	4608	919084783.exe	110
PID 2340 wrote to memory of 3284	2340	cmd.exe	112
PID 2340 wrote to memory of 3284	2340	cmd.exe	112
PID 4680 wrote to memory of 1476	4680	cmd.exe	113
PID 4680 wrote to memory of 1476	4680	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\919084783.exe
"C:\Users\Admin\AppData\Local\Temp\919084783.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\dbcTMP\Fav~Url.tmp
  C:\Users\Admin\AppData\Local\dbcTMP\Fav~Url.tmp -y -o"C:\Users\Admin\Favorites"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fbinst.dll "C:\Windows\dbcOnce\SUPPORT.IM_" output IMG/* %~nx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\fbinst.dll
    C:\Users\Admin\AppData\Local\Temp\fbinst.dll "C:\Windows\dbcOnce\SUPPORT.IM_" output IMG/* %~nx
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 50&reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "www.hao123.com.bz" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 50
    3⤵
    - Runs ping.exe
    PID:2696
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "www.hao123.com.bz" /f
    3⤵
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 3&del /q "C:\Users\Admin\AppData\Local\Temp\919084783.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fbinst.dll

Filesize
124KB

MD5
fccff3d5e754a1085fef98eb3e8692e3

SHA1
5cbaf970ef9b6aa0d3f483696d7b237ddd34d35b

SHA256
2387ffc71eafbe8ed499cf17fcced69313eb3235ad2ed107c91e3eabc29462db

SHA512
ea766834f0b398706d410f99d323c8c0f1cae768697bbdf28776fd64bccabc5bf4e307eb7bc12c6c182336006d9b7f4848595323f6e9946753da037f1684a008

Download Submit
C:\Users\Admin\AppData\Local\dbcTMP\Fav~Url.tmp

Filesize
142KB

MD5
784823cfe98f41e645af6eaa0879d227

SHA1
72cee3514f98fc79da3254dbf10975e54794ddd1

SHA256
66ea7a41c6deee45e53155cd4dbc30a4837eb50a3b3d4b7ba692926350a87f91

SHA512
59734096ff25e777ef1fe20d6c989d3fa2a7750be041366217b518d1d30b89cba33412a384d0c0b89be3cfcde615646610d8498e16c7927c3f8681795c704435

Download Submit
memory/1624-65-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4608-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4608-8-0x000000000047E000-0x00000000004C4000-memory.dmp

Filesize
280KB

Download
memory/4608-7-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/4608-5-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/4608-4-0x0000000000A00000-0x0000000000A3E000-memory.dmp

Filesize
248KB

Download
memory/4608-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4608-1-0x0000000000A00000-0x0000000000A3E000-memory.dmp

Filesize
248KB

Download
memory/4608-6-0x0000000000A50000-0x0000000000A52000-memory.dmp

Filesize
8KB

Download
memory/4608-3-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4608-66-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4608-68-0x000000000047E000-0x00000000004C4000-memory.dmp

Filesize
280KB

Download
memory/4608-71-0x0000000000A00000-0x0000000000A3E000-memory.dmp

Filesize
248KB

Download
memory/4608-74-0x000000000047E000-0x00000000004C4000-memory.dmp

Filesize
280KB

Download
memory/4608-73-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads