ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

114IE.exe
Size

3.1MB
MD5

6da132acb38a83304f35543dc670e184
SHA1

688936ff1b95cefaa04c36e6a662719a59965b09
SHA256

ff1dae85ff708d8a51b99b0400c07fa068df6d953b597a422021019496224f69
SHA512

3dbbe03007054fd7d2a6153f775d1f4a092376ded43693a77100596939ad8595833c66834208188237a961d031e39a6f41ecd1aaa61243bdadb2cb57e9425f54
SSDEEP

49152:LubHDDMxSIVdydRr9/UWcTNb4Ywgl5vDk38zAU7Ebwnwp/6hYTe:Lu7YM/h9cTNbVwfMeKC6h

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	114IE.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\114IE.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\114IE.exe:*:Enabled:114高速浏览器"	114IE.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List	114IE.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\114IE.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\114IE.exe:*:Enabled:114高速浏览器"	114IE.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\temp	114IE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	114IE.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	114IE.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	114IE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\114Web.exe = "1"	114IE.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	114IE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\114Web.exe = "0"	114IE.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	114Web.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	114Web.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2144	114Web.exe
Token: SeIncBasePriorityPrivilege	2144	114Web.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2232	114IE.exe
2232	114IE.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2232	114IE.exe
2232	114IE.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2232	114IE.exe
2232	114IE.exe
2144	114Web.exe
2144	114Web.exe
2144	114Web.exe
2144	114Web.exe
2144	114Web.exe
2144	114Web.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2144	2232	114IE.exe	28
PID 2232 wrote to memory of 2144	2232	114IE.exe	28
PID 2232 wrote to memory of 2144	2232	114IE.exe	28
PID 2232 wrote to memory of 2144	2232	114IE.exe	28

C:\Users\Admin\AppData\Local\Temp\114IE.exe
"C:\Users\Admin\AppData\Local\Temp\114IE.exe"
1⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\bin\114Web.exe
  Tango3 393652|2232
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

DNS

www.tg1234.com

114IE.exe

Remote address:

8.8.8.8:53

Request

www.tg1234.com

IN A

Response

www.tg1234.com

IN A

203.195.130.175
DNS

www.114.com.cn

114Web.exe

Remote address:

8.8.8.8:53

Request

www.114.com.cn

IN A

Response

www.114.com.cn

IN A

218.5.79.45
DNS

ie.114.com.cn

114IE.exe

Remote address:

8.8.8.8:53

Request

ie.114.com.cn

IN A

Response
DNS

union.tangobrowser.net

114IE.exe

Remote address:

8.8.8.8:53

Request

union.tangobrowser.net

IN A

Response
DNS

img.tongji.linezing.com

114IE.exe

Remote address:

8.8.8.8:53

Request

img.tongji.linezing.com

IN A

Response
DNS

www.tgsoso.com

114IE.exe

Remote address:

8.8.8.8:53

Request

www.tgsoso.com

IN A

Response

www.tgsoso.com

IN A

154.39.73.176
DNS

www.languangav.com

114IE.exe

Remote address:

8.8.8.8:53

Request

www.languangav.com

IN A

Response

www.languangav.com

IN A

43.154.18.100
GET

http://www.languangav.com/tango/templ300.zip

114IE.exe

Remote address:

43.154.18.100:80

Request

GET /tango/templ300.zip HTTP/1.1
Host: www.languangav.com
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 1.1.4322;)
Pragma: no-cache
Cache-Control: no-cache
Connection: close

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sun, 14 Jul 2024 23:10:15 GMT
Content-Type: text/html
Content-Length: 548
Connection: close

218.5.79.45:80

www.114.com.cn

114Web.exe

152 B
3
203.195.130.175:80

www.tg1234.com

114IE.exe

152 B
3
154.39.73.176:80

www.tgsoso.com

114IE.exe

152 B
3
43.154.18.100:80

http://www.languangav.com/tango/templ300.zip

http

114IE.exe

529 B
903 B
5
5

HTTP Request

GET http://www.languangav.com/tango/templ300.zip

HTTP Response

404

8.8.8.8:53

www.tg1234.com

dns

114IE.exe

60 B
76 B
1
1

DNS Request

www.tg1234.com

DNS Response

203.195.130.175
8.8.8.8:53

www.114.com.cn

dns

114Web.exe

60 B
76 B
1
1

DNS Request

www.114.com.cn

DNS Response

218.5.79.45
8.8.8.8:53

ie.114.com.cn

dns

114IE.exe

59 B
126 B
1
1

DNS Request

ie.114.com.cn
8.8.8.8:53

union.tangobrowser.net

dns

114IE.exe

68 B
139 B
1
1

DNS Request

union.tangobrowser.net
8.8.8.8:53

img.tongji.linezing.com

dns

114IE.exe

69 B
138 B
1
1

DNS Request

img.tongji.linezing.com
8.8.8.8:53

www.tgsoso.com

dns

114IE.exe

60 B
76 B
1
1

DNS Request

www.tgsoso.com

DNS Response

154.39.73.176
8.8.8.8:53

www.languangav.com

dns

114IE.exe

64 B
80 B
1
1

DNS Request

www.languangav.com

DNS Response

43.154.18.100

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-7-0x0000000074083000-0x0000000074084000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.