a4f7496d8fd21533829214390b580acbd74031cd33136c40df9a64cc8714c6ad

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

安装与配置说明.htm
Size

7KB
MD5

d6bd1ac97ed7a264ee2f3e280925c85d
SHA1

bb2c217de3e132e66643cfb03517522fdd8c04d7
SHA256

463d264595cb88fbf4c79b2a29f47803464fd74ac4db8812b62cd7c93215ce6e
SHA512

551c01603b8f58687a1f3e6625799750e8633590fbe95357433c26bee82fd3f4c51c5b3492646e229190f07f3a9ed37804d6696368dd895a6a2fe40434f82ae8
SSDEEP

96:c2F18SWQEVfTvIiHm7sMR0MoeIiHm7s8a5nPxJoXj3LyWTU1QJIS8yrvmgltMJWa:LFS+IsboX7mgPMJ4Id8Z8CxId8Z8Ub2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f188c3e0e637c3d28bfe14b00b75f7aee684f6a98bd9dcea764cd700fc51d251000000000e8000000002000020000000b1d4811de502f8d3eeca24a2e89f1dde4ae7626a229de506a61b3cc52aa3878290000000e4ad2766d7fafa850ece2da8d8457821f5024c8ac8dce4c4c9d7c9440f88b6d35cb7faacc7b80202c25a39b481d709c9a7c8b970f091bf5742d97527ee2a49b3e5241a764187caeb79517d035fce21582790fcec9ea297a04e3b33fceacb8e9faf934e7ee7f5883b46ed4992129e38cd3ddfc396f3be6cf72380c67102cca5f571d5954c40fd6d9653b4406aa59db0604000000011d40edab99516dcac4e01b63ada06415705e03d8e049c56f1e3c3cd050f24e90ffe96d8f5b505e5d360688a18ffd74f966d3c91f7374364f89392151f515d25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72464871-42E7-11EF-A1BB-725FF0DF1EEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000060b99038763c8c1b9b5f71325eb9391e44f32908304fd07ad2af3e1f5c39a9a7000000000e8000000002000020000000d6e8bbd8a8f7318213d71390d5a5f2315bee6906b95279b1e425e79c840d79eb20000000c357c49b14815d938b5384d5f55566207a533a46c2ea7c46e46583b1b2dbd2b340000000d1b805f038a5cceb96fedc6c3aba3697fefb1ac15ae4e042c4b6c601e3c85bfeb22729e4718c239e8fa03f97575e5728cdb15aa6e03e851f946a38ea475b3690	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427236600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e3d946f4d6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\安装与配置说明.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdeef1f46134c5f7147a26a4c9188043

SHA1
4161c575899350a1b6dcc6c5e242c2325aac5a51

SHA256
bd93fbcc8a9ec1d59f5b63b250450e781d923cbedfc8fb18b87dbb1d0ff2c09d

SHA512
739e07b347e79ba260f1db81b33b765bee0a682cadfb0ca66b5871a836df8a4a7e064f6a93cd37b195c1488644c814196d4c24dde08241c74eb622838ecb9a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
873218dcb5da47f6b12980dcb06a9907

SHA1
737b248103afa1a023df7baef9c12be423e6e0c8

SHA256
8dddc71722dbcfef863496da42295636d23b1e23dbb1a31e9bf33eb07616e2ba

SHA512
7e32e949f55edb8a8fce2d95ea5a04751ed9f595c5104673a1fa3a37243d354817f31447c824930e71b976e4d5faf3240b7fa39e941def56d9be2c58e9522a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c68d4d4e209d48ac4ff0f3d77bad50f

SHA1
d80e6d298db0f2266cf750351ce1588d23cf1c7e

SHA256
2260c8dbf30091239c1b8fdcf141a680466ed9fe68f3f1b95a84957c91b9e9b1

SHA512
6b1646ffd1acc3cd19b924a1406e6cabe0c180e036d603a62bae7114a3722bf47d42b9a393c768c6f8e5d97cde9d75b66cfca1e8349fa441b9c7415eff91cbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b9f4b9ee77d64d3a1951b3099b73646

SHA1
2d017a01bd23b5004eb950356a9bbeaeb5b3f6ae

SHA256
4061142f43dc26316c64cdf375340ba4a0eb99c5e247035620912710708efcb6

SHA512
8e0e5b493c8e22d82d3a1b3edd09d13897a0a9c3ac25003aab3d25e96c8f294c4d475c3a927bcbbf80e04d6fc5c98edb2b0f1ec2b968e74b6a0bbc8db00b67e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40fa587075996048e1f09eb3f990fe79

SHA1
88bbd0c95742e7812353a657396b028d9746e953

SHA256
887b5fdf2ece59363b559748cc2aa00da2f982185a651eeebad20a37023276fd

SHA512
8d07e3531d94aa40e7f5d672c7c0d66101fbfc6730cfcf5975eb7e4bb5c5bb8174bed495c15cbc3c2921ef6e63ae1f1b0bf6209bfd96a3b840bb623e701983bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a430ffb9c4f7b06f3e309fbd70896582

SHA1
ad3f80b295985213c5c40815a2f76b8ff8012282

SHA256
75605c87e127882a241a2b4f46606b19ce177f47f04f0903f467991a7d3cbf2a

SHA512
2f36d4073b83b3d82d6b3fc5e6996004cedc04497bd55ad5032a092783ad2e52af19cabd6cfc6dde425134a22a59d9418911ead8087e4b979239eb06a4f88503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
005260f9caf5ab4a5a6c9a9ac02bd0d3

SHA1
7ae2a6c35f74d7b5425b8a790399be5d15d74993

SHA256
776047f188154daf57f67c9983bd8e125e5aedfa9e405e1b5af6060a36d6c922

SHA512
5611e2e11701ee69a2fe5cf993673f8ac53f6dc0fec7c97ea00998b76e9b60b7662d1e8288d32e251f9d84d5f8a08c26e096dc93e0f599f61e59c01f16a91e24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a12b8404f7a342b5b076e908dc2daba

SHA1
f3924f80d666c7cdd8f3feb60f923196fa77fa10

SHA256
363a36184d238fbb14c72357036f3fabc04652058a4d4fa24b76dddfa6cfed63

SHA512
f994c8eeaef0058bc2ae0da87f05e4112e477f085a70ce533785130e338f4c7598395eee887ed3a1160aeb8112195ea9425b1a71439fcc9924e06bcedc94df3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1a82bbebb4e45cc89dc6aaebafe72a

SHA1
2ec02e468acf5066886118471af3b49b3cbfbf92

SHA256
4ac5e00701085ce721c8d476e4f33cdd0a5c35affe36e0ebb89ace7122a215f2

SHA512
5cda3b25b2feea4494d93025910225313503072d1c0ea8516aea29627874ff6e0cceb0ad0a47b0cfef0925e351b74b906dd0a8c86fc9c551abf446b9f76a5e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3027.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3088.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit