Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe
Resource
win10v2004-20240508-en
General
-
Target
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe
-
Size
6.0MB
-
MD5
de1a28f43d8670e547d07ae17e8ad2bd
-
SHA1
58d4ea98ec60e111ab71c4acb2df4bdb6bb8a79a
-
SHA256
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6
-
SHA512
156698fc282aab08a0e35f51b8d72dd601008d319b255a7eee96781eb60fb3c4c5b3f763f1b402f7aa4322cbcc0cadbac05e190a580710a2c116c771ebc85c52
-
SSDEEP
98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLC:fbdhDD23a2sWKjr+TJV2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exepid process 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe -
Processes:
resource yara_rule behavioral1/memory/2124-1-0x00000000003F0000-0x00000000003FB000-memory.dmp upx behavioral1/memory/2124-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-2-0x00000000003F0000-0x00000000003FB000-memory.dmp upx behavioral1/memory/2124-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2124-58-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exedescription ioc process File opened for modification \??\PhysicalDrive0 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F4AC011-1B49-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 576 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exeiexplore.exeIEXPLORE.EXEpid process 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe 576 iexplore.exe 576 iexplore.exe 1128 IEXPLORE.EXE 1128 IEXPLORE.EXE 1128 IEXPLORE.EXE 1128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exeiexplore.exedescription pid process target process PID 2124 wrote to memory of 576 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe iexplore.exe PID 2124 wrote to memory of 576 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe iexplore.exe PID 2124 wrote to memory of 576 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe iexplore.exe PID 2124 wrote to memory of 576 2124 09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe iexplore.exe PID 576 wrote to memory of 1128 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1128 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1128 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1128 576 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe"C:\Users\Admin\AppData\Local\Temp\09be3758c034aee089b97e0116acdb529ec745b253fafe0ff99b08291bb739f6.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://changkongbao.lanzouq.com/ikW9T1cfeg5e2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fe6e8d948e5a0d0710eb62377ac68c5c
SHA17c9a8400fd0b35b33b6a8edff21098921f052545
SHA256992232461f46d1de402f5fc1b021717303188c883e27bb32441789b5235fcffe
SHA512fb4366a5da87ed53fb1c7d0f55589e428b36b5fbb867a30edf644863c6a8378c766824e2747edcb0060d82ec35444571521675cd33826992c8dee7c9548e26da
-
C:\Users\Admin\AppData\Local\Temp\Cab586E.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar59BE.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\·½°¸.iniFilesize
10KB
MD5842d9e10867153ad73a1a80d79afef13
SHA133a49d893273182e8aba6e9531c3077d4ab86516
SHA2562823197bddf0203ea011003a4e70f2687da234a3388b5090a76da2c2562d33e4
SHA512e6e10f63c7d3e65358bd6e66a7328f7d06d096b2ed936cd4504cfb8c6b5f4081dd55884bb915191156965b0eb9b3fda6a97b5b1a1eee45d59a41a4e375d1e518
-
C:\Users\Admin\AppData\Local\Temp\·½°¸.iniFilesize
8KB
MD55d009e3acced727e465875436f8c9560
SHA1979b4e50a5e67b26807ed8517a62bb6e748ccb49
SHA25621915ce3d43c7581dc14bc33388fd45150c02f18f3ae9c150c19943fd2b0613b
SHA512b15cbcf14972477936239d6f528cf8caa5bb5b367231b73292670aaa8f159cd92396b2d71c41e72dc137f4f3235562415a7759c061a24ba2e9edd1511d9c83af
-
C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txtFilesize
189B
MD5322f59ce015ff2f1f00ecbe4fdfce380
SHA1eb4756a5bb023f6d1feacdbeac6e94013e15d5b0
SHA256c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1
SHA5122610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c
-
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.iniFilesize
246B
MD5b06ddcfdb64cc28ca0a0ef609de5f05f
SHA1bd95d141935795e249d2ab00824839fd42c8f505
SHA256da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00
SHA512a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5
-
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.iniFilesize
260B
MD5924bf7a4ce305dad87743ba3c5773aa9
SHA112d0fddb472394b23e5176ab4ede38974e723b81
SHA25601faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd
SHA5122380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e
-
\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.libFilesize
1.5MB
MD5ef48d7cc52338513cc0ce843c5e3916b
SHA120965d86b7b358edf8b5d819302fa7e0e6159c18
SHA256835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8
SHA512fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9
-
memory/2124-49-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/2124-20-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-16-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-0-0x0000000000400000-0x0000000000A6D000-memory.dmpFilesize
6.4MB
-
memory/2124-31-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-8-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-12-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-10-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-52-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/2124-55-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/2124-54-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/2124-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-25-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-18-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-14-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-5-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-6-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-4-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-2-0x00000000003F0000-0x00000000003FB000-memory.dmpFilesize
44KB
-
memory/2124-3-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2124-1-0x00000000003F0000-0x00000000003FB000-memory.dmpFilesize
44KB