6bc088efcca40085f6c711a1b011f9947b97ed2538f5f280d4b82ec3116462d7

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SMPROGRAMS/Ա.lnk
Size

1KB
MD5

62d588bdb74e4e2e5d1689fa9272ce39
SHA1

9d0db515d8f65e57353381d707060f7343a74da7
SHA256

248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
SHA512

cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{699D6E01-4207-11EF-91DA-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1092e35814d6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000003de2e781909acef9266f01adc47fb21ef9b7b18b72658c17072622daba7cc61e000000000e8000000002000020000000b67035fc6a0d0e1527292a1a808d32123f8b0090f079958394f5368bee2cfaf3900000002b68bd024a4584b442fc8199dbe763a252e869d70a9bfcb23c81b9c9f2faae2b1c88e438d69cfe4568cc7e6b51a5a4631574c6303848d8128bb51fed46d6278540026fde934c96737499cad4dd80970ab430d63d5cea7283ba91a4f1ebac0edd485e9e4645df295c18e29e02372903f181aba91adf9039ec24486f60288acab29c1f0d1d1f4a298b3817a6e9ba9ddddd40000000c4b21944855e1b4ed944404d13e79eb41d50b14a547e23aaa71d07beb878387ea95c537f6e83f8a6c0fc480d4b3d5298de37843b3c09cad3bba0c16a956f94f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000037f7370ac91c13f8e10e5f17f9f400f49c3350ac7cf99bac8dd303e80bec1605000000000e80000000020000200000006fcdaf29cfa362153afb011a99399cadba5e0c5a562ae5a19f733b9830d38a7c20000000056cafd06c52cd1b9f66de9e61aeaf2219bb15784d6b18c24db2d7e98395ad8b40000000d7e14c3dab9f0519acae35f7f6e2f2c09ff5b5493f1640ed301ff66005414a3fcc61f2ab22f51154356f1444acd4aa3dab3f6a9d6c9d8057cfa9da706cd9b51f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427140375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2868	1304	cmd.exe	31
PID 1304 wrote to memory of 2868	1304	cmd.exe	31
PID 1304 wrote to memory of 2868	1304	cmd.exe	31
PID 2868 wrote to memory of 2980	2868	iexplore.exe	32
PID 2868 wrote to memory of 2980	2868	iexplore.exe	32
PID 2868 wrote to memory of 2980	2868	iexplore.exe	32
PID 2868 wrote to memory of 2980	2868	iexplore.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$SMPROGRAMS\Ա.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.mai520.com/?taobao
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a648609ff81a63c791af37091fdf59fa

SHA1
8b5f6d44244a689549798578f0e0d5fa3112854a

SHA256
18d5c692a7019b57da89071068ff7b4b25427a14fe52336884e3696ae01272b4

SHA512
32e48c1c202f37b7bef01bf88a2e602f7482a7cda7a28047434303b9a95f3cf6669470f51903c438a27a3f60c2292fd4ecb66093fc169531ff522a07333175a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe28a8907aabf1455dc2d1299908fd59

SHA1
74e548d52d7f32326525e51479a3d8ddbf3e4ea5

SHA256
c10a0ebd14d9c8ce77ec1b907d6bfae6c81d2ea4e5cbf22d97ac3590f3facc1a

SHA512
5ac85bc0adccebd5adfbd03b6a8da3f0d5d524f643b83bb04398dc633a14d27b858b4e96186a736942160fdd8f64864bbbafc57f15ea82f6145673868b8b3c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb5e72210470ee70525455f0cd03ad3

SHA1
2a5a414a609dac9f131596a2ef42cf5d4c7b656c

SHA256
063ad3ddd31e760d06190dd9001e7ef634561637a0d1b6b4149679b4b172f591

SHA512
b332573994959401fd7e59c53d1b1efaa762f41b269c7cc36738eef194e25d88f31f1da81e045c8e85ba241c3a91d693ca109825bf8cef6076ffd4639dbcfd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
107249fb938bede2e196d466c62d3088

SHA1
c71f6059afbbb03542f57e3375f26a4f3d6eb119

SHA256
d4fa670c2cb959309aa5a8d7b1e590793e1cb9927d62ad69a1f67cd9f375d160

SHA512
636650b90a6cbb208d408f03b3a4fa7bd02a51f1081d782093d6221f2fe8f9963af8926938ad8c5e11374b1f9b6a04deadad296bc365b03cf52375e2cc529cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8a475803751a2a687600bf6bcf1f465

SHA1
baf64c2e6f26691815a532c1bc7164791c443f04

SHA256
198436389cce269be224ff5c025587c199975bdab8557782f359a07fb1995614

SHA512
628fc97fb33c751d7123faaba101c8c42dc6665e3572d9fa47923e76b6a607812e9c6234e47307c47f9c37dba9cfb0e0f9fd79965304a352d15bc00790166148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9505edb30a479a5d41801cc20cd4fdd

SHA1
a6c165f4780553e6498666ebf82487c5fb46e88f

SHA256
00304b39533a3e131f69d6bb5ac0d9ec0d6757fb9a7326d0a09eb0b802a1a3ff

SHA512
6705a015a25b4edcea407a3ccb0de9321c105f6741e422987420a0c371a2bbaf48fbcfe06c8077417aefafa29e0a4d3ae3e5624b5dcd85d3e9ce7e0e2109250e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3818221ffabb29e9b8d51b99559e774d

SHA1
c48a18b039da5b807edd6b931ffd0806d4d6484a

SHA256
c4b9aafa867348bc4b561059dd6b34578c2137ecd58b692d1483aee5cd69fc4e

SHA512
7d6cdf37be34e3502ed0adcbe0667b65e858313f2f86b062a6c957a343e64902b80db97d2a055f78d52f08950ff81a6eaf0c9f3c5c272323d045937791ad6505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c322f08037b3b0d225a6dade60f3c17

SHA1
1ca17336dec123b6724a67ea6b27e4e6da1783b5

SHA256
d7348302bcfbac659622ac2fd4aac17458fb4637ec68adeb902f4e249ca2c3ab

SHA512
251ab9611821b40c8213ab1e53fa7abff0a08ed1d41d6d1c3ee50f68be0587931f64ab3317531271fffd48a6030df6b5133a3200c8c882ab08e6513ff24f1e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4737ecca8d7c62976539c814d96d5059

SHA1
9629f44a117636d6a7dd83da13c61b168783006c

SHA256
76493e9bdd58685a2e274e8c424a39d4e035c475cb47f998ada71ce074fd234e

SHA512
4d21e281169e2cd2e677c22c3f2b7683caa3a0a90f7a55155d83b1bb59b65a214ab013223d6338313fd23639bf26e7f799898ee74b3a4f8bb403988533790117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4fe8721d8409f95df8329cf2714c3b

SHA1
a5a848f406363afa16f60109a1db06c8bbfd2656

SHA256
ad946f36dbd8897b2d88c57420439faeabbd1e403b54832e1d5b51af3112cef3

SHA512
6012b42e82c1b0d612e369185a247561cdeeaee22be2d35fe5aa24383e15d166bd6988acf99000e1c7d3dbadc35908f7da6c61d33d0b19c9dfc3d99b3e5fdf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D08.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D2B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit