1f7bf9df9b0ad3779c9d91448fea26db82cc6b06709c114c953bc6d512b32577

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

611c69111c159fb3f5f30ecb9dae03a0N.exe
Size

232KB
MD5

611c69111c159fb3f5f30ecb9dae03a0
SHA1

fe60151feb5cf19f725ee20640987134b4345191
SHA256

1f7bf9df9b0ad3779c9d91448fea26db82cc6b06709c114c953bc6d512b32577
SHA512

2f411f85c1c3b4b11a8f6750d8b885ea74b047d689366e6fa70e5d537081022799459a75d390c0af976643a3d6f6cee78cd90916f52e1335e91c8bf03a176a70
SSDEEP

3072:Q1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:+i/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	611c69111c159fb3f5f30ecb9dae03a0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	611c69111c159fb3f5f30ecb9dae03a0N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x0008000000016c03-10.dat	upx
behavioral1/files/0x0008000000016c7c-11.dat	upx
behavioral1/memory/1620-444-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	611c69111c159fb3f5f30ecb9dae03a0N.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	611c69111c159fb3f5f30ecb9dae03a0N.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2988	cmd.exe
2196	cmd.exe
2760	cmd.exe
2548	cmd.exe
2076	cmd.exe
2244	cmd.exe
2312	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	611c69111c159fb3f5f30ecb9dae03a0N.exe
File opened for modification	C:\WINDOWS\windows.exe	611c69111c159fb3f5f30ecb9dae03a0N.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	611c69111c159fb3f5f30ecb9dae03a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428739232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	611c69111c159fb3f5f30ecb9dae03a0N.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000040c92d580745186fe469b87fa85c50c67392ce6769746f363edd926845e93627000000000e8000000002000020000000499ae896e49c14312e0e24820d1bf2ffb1f915e29a411c56a3e0ba4db6dbdb0f2000000050b59c47647af83b62fe171ad3456a185e7c88bcfe697f1381971cd65438fab340000000dbc3c5fa12c735941fab7d7bf8809ce25627912b97e35b4361ade5b73a4bfb0cdfed7f832f2988a07fcebc3ab40cc63d94cd4468d6716f90e4f3d586ffbf7d26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009175aa9d864ee29ca475009e4f25f1e28a4e3cd928739169016aa356c7ac3858000000000e80000000020000200000009201166d0ec19a9201b9daa1852dc3f015f010d02e4122aadbd5097fbc73e95d900000008149570c504105f850488a8d4765954b8a34b782b7c806f9951c1087a73f48c7f9b2a5ec49575785befe343e043222286f7c8d4dd235f81b44e5b3b04106797072f5ef646b7dc8eb1a767fb48831a202b7a4ffc9009d1062faa196f74ae1eec75bd0b8299e067f9415e89c2dc62452622a8c70a677e6fede0441a7f81ec259ec05da741e14beb2dabaad74f70c08809d40000000cfa45bdbb50284074f2453e1a5d089d3ed0d7480c86d196d5f06bee2a3e63fa6755de5ff946685db715382573ff5098804f17a31563f9386b193b5d60424367d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09F7F8A1-5092-11EF-916E-DECC44E0FF92} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806c45e19ee4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	611c69111c159fb3f5f30ecb9dae03a0N.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1620	611c69111c159fb3f5f30ecb9dae03a0N.exe
2836	iexplore.exe
2836	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2836	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	30
PID 1620 wrote to memory of 2836	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	30
PID 1620 wrote to memory of 2836	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	30
PID 1620 wrote to memory of 2836	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	30
PID 2836 wrote to memory of 1716	2836	iexplore.exe	31
PID 2836 wrote to memory of 1716	2836	iexplore.exe	31
PID 2836 wrote to memory of 1716	2836	iexplore.exe	31
PID 2836 wrote to memory of 1716	2836	iexplore.exe	31
PID 1620 wrote to memory of 2760	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	32
PID 1620 wrote to memory of 2760	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	32
PID 1620 wrote to memory of 2760	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	32
PID 1620 wrote to memory of 2760	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	32
PID 2760 wrote to memory of 1760	2760	cmd.exe	34
PID 2760 wrote to memory of 1760	2760	cmd.exe	34
PID 2760 wrote to memory of 1760	2760	cmd.exe	34
PID 2760 wrote to memory of 1760	2760	cmd.exe	34
PID 1620 wrote to memory of 2548	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	35
PID 1620 wrote to memory of 2548	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	35
PID 1620 wrote to memory of 2548	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	35
PID 1620 wrote to memory of 2548	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	35
PID 2548 wrote to memory of 2612	2548	cmd.exe	37
PID 2548 wrote to memory of 2612	2548	cmd.exe	37
PID 2548 wrote to memory of 2612	2548	cmd.exe	37
PID 2548 wrote to memory of 2612	2548	cmd.exe	37
PID 1620 wrote to memory of 2076	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	38
PID 1620 wrote to memory of 2076	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	38
PID 1620 wrote to memory of 2076	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	38
PID 1620 wrote to memory of 2076	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	38
PID 2076 wrote to memory of 3056	2076	cmd.exe	40
PID 2076 wrote to memory of 3056	2076	cmd.exe	40
PID 2076 wrote to memory of 3056	2076	cmd.exe	40
PID 2076 wrote to memory of 3056	2076	cmd.exe	40
PID 1620 wrote to memory of 2244	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	41
PID 1620 wrote to memory of 2244	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	41
PID 1620 wrote to memory of 2244	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	41
PID 1620 wrote to memory of 2244	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	41
PID 2244 wrote to memory of 2748	2244	cmd.exe	43
PID 2244 wrote to memory of 2748	2244	cmd.exe	43
PID 2244 wrote to memory of 2748	2244	cmd.exe	43
PID 2244 wrote to memory of 2748	2244	cmd.exe	43
PID 1620 wrote to memory of 2312	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	44
PID 1620 wrote to memory of 2312	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	44
PID 1620 wrote to memory of 2312	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	44
PID 1620 wrote to memory of 2312	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	44
PID 2312 wrote to memory of 2528	2312	cmd.exe	46
PID 2312 wrote to memory of 2528	2312	cmd.exe	46
PID 2312 wrote to memory of 2528	2312	cmd.exe	46
PID 2312 wrote to memory of 2528	2312	cmd.exe	46
PID 1620 wrote to memory of 2988	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	47
PID 1620 wrote to memory of 2988	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	47
PID 1620 wrote to memory of 2988	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	47
PID 1620 wrote to memory of 2988	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	47
PID 2988 wrote to memory of 2360	2988	cmd.exe	49
PID 2988 wrote to memory of 2360	2988	cmd.exe	49
PID 2988 wrote to memory of 2360	2988	cmd.exe	49
PID 2988 wrote to memory of 2360	2988	cmd.exe	49
PID 1620 wrote to memory of 2196	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	50
PID 1620 wrote to memory of 2196	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	50
PID 1620 wrote to memory of 2196	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	50
PID 1620 wrote to memory of 2196	1620	611c69111c159fb3f5f30ecb9dae03a0N.exe	50
PID 2196 wrote to memory of 2936	2196	cmd.exe	52
PID 2196 wrote to memory of 2936	2196	cmd.exe	52
PID 2196 wrote to memory of 2936	2196	cmd.exe	52
PID 2196 wrote to memory of 2936	2196	cmd.exe	52

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1760	attrib.exe
2612	attrib.exe
3056	attrib.exe
2748	attrib.exe
2528	attrib.exe
2360	attrib.exe
2936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\611c69111c159fb3f5f30ecb9dae03a0N.exe
"C:\Users\Admin\AppData\Local\Temp\611c69111c159fb3f5f30ecb9dae03a0N.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b2161802d34d99937bac344117fc83

SHA1
dfe70d56d5669ac3f92856af85700f5c6b8aed2b

SHA256
261bbc6d5df04fb317bcb8a2491a0d6c1e6f78e647efa7fef0d6c70b4dc1bb9f

SHA512
2fd1d35bc023ba2b3cfdfb6d842ef923df1d4cfd2ebdb88fc06b4b8c856f792e7dc271f56a3bdfa6fec1479bc9ebf04addb7ea170b02560819ecd4ddd9144f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff1c7b05d7b239c019c2d10801cafb93

SHA1
b923a2a2aad933dbb2e3093bd1d4a89237b3835b

SHA256
2393d223086e54c777b9f301e5d78f76709a0ada37e176acf73cff3e96e60eee

SHA512
dbe9e55ae7238f003e7b2affe8c391ec442171ea19bd3cfe2861604e2ecdd2650054bd0c7b9eda6f8d1ca3fe1e722f3c9b32d2758dff4f17fb8fed39902a2e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cec0fb6a8da94058241b5ae41c20574b

SHA1
e2269c31332b60869ebb8bf74affdf31e3c5e1fb

SHA256
6e86708b051a1ee8811c8aec00b26dd1d1bd900df4d3c6e1a411d6e7c6000ea7

SHA512
dfc525256aa962473a8c84531e9a394ac527ffccb86567acb7b5ff9cb7cb7086b4e045abb958d06096c0a2dfd64d41234a8119d3bbedfdf2333b74b0c10faf93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb2f3c8466d65c9b2063f7d16d2242d8

SHA1
0fecab9bb5fea839e52bf5efbf15940d6c776f54

SHA256
31563a61753046c6c166cbde2feb4655d5c1819f32a317a69821f9f4bd5a63cd

SHA512
d571f2cdf20b7fbea72e82597a9b60964c364498a2f73390177b24fb72147ffb010169ce2418eb96e3022d5959be5ad7da37bc8bdd3e9e7a9112a4f4ec974db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e2b1fe2b95f38dcb63c717a3ead1939

SHA1
a97f413b701a8d71a72e2ca0fa46d8abff6f9edd

SHA256
da2b467223656139f1d72a9961a15171379e7ff4c2014fb6e042cd71b2203e34

SHA512
c9a26c20e0eee91657f1c9e76a7a7f2a3938e965c1b76f03efab469c9bfcdc1d4de657385de8603e40683ad7d51eae9ea69714b6c96fc1eba1870c92f21a79ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a01c61314cd503deef70f948ec04d67d

SHA1
415d28f45aba5e224bc3f4a52c17acaddc71ed23

SHA256
c83b15f9864b00f1495a8dbf3a49fae48076a59296b1fe79a38f59f5c62f67b4

SHA512
ed3ddf753b98d1bedd56138d6eea3cc5c6abbec4f60c736dea7b09500f32ae6c4bcd364f02ae307fcbde1570757f0e0204688e7566b286278ad81e48962b29f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2e44e05827cc44c4a32a8263f6983f4

SHA1
c6a826e4635078a8ee63adbfcf7bcedd76f7162d

SHA256
f7d6c9e2578ce1ca00b717b30e0b8185a56778502ebb863a4a0e2bbf2e440d82

SHA512
13d870b4791049013c1369d7bb81de10914287ce9bc5c9f98d5621cd10e8584ff557834296d332fdcd3e7201d4f47bc09bba764db56e07e62a0221d18f5868aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c9d22412d7f2d34cc4e7655219bc9ea

SHA1
38265d068e48f5bbe09fc8a1d35f60a19adcb1ba

SHA256
ed2d681a3251103d5ab96347d44ddbc5b02607d4e28c5760748143e42759d2d6

SHA512
6e9957ab7f6dd24e9db16658f044cf49dd89643be3a1f1e55efd89e7b7ab9569dc9319f07d73ae2513cc0215d269c72d846a749a8bdb784faede44128569f9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb91094c5e5a49d43e1ecd0691732df

SHA1
ae8990f10b8dc9fcd6f4c089a5876298bd4ba80a

SHA256
15303b0206576b8228af808f7ec1350ca83c927353623375b5d3fa97af6b0631

SHA512
d830eee5ff70e0f6cf5c97fae6803b99181a265e485af7b73416da4cc11169fb981b1e4e0dac66816a8d65ce9c44bc9bcc8c9acc7c521f4064473e0413e768e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2472485ebf69321ed73b7b3a5dffab3e

SHA1
00bd17d8b8a25ad820d902bc6474fb8d7230c131

SHA256
de823cbbeb383b33e0aca86012664dff84294f1cee9eaa7b01b35506aa784035

SHA512
bf2935a648374c17e919d75355f81aaf8febd548103a4a73817807feb8c552c3dc0576385534856ba8c5cf4212101a089cfc11afaaefc54e063a517050949a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15cf518304ff9472621935a5b648c891

SHA1
ff83167e2c68f4fd80e1461b3ebe6abf604fbd94

SHA256
6d0c523c1f504145eeb41977d7a52d32646305134ce9c4eefbb30bca216c617a

SHA512
35401723205fa20f5bb0cb0d39f754cc3275c56d23ee9e29d91b608ac524597d324d57481b4ec0074200a721abd2e6a197525fe3d9deb0280657a07129170e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726fb4b98c4f1cbd8d903db64c77822f

SHA1
a48cf6ff88943eea3c055c9ba38178da3d49b99d

SHA256
b221811a755bcd290fefb8ec0545f816d157f1445a6a30b17ffe5123589e3440

SHA512
9d6583d15bff3e3180504a7003839da5032fdc4b97dac1dc499ad59588c0aa46e437d817742ad78a7be25f69a9a1813753d754761263f646b151272dd208955b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b621637caf676a3b300d2525a4e00a18

SHA1
2bf8c324e2f11cae4258846f1f21889e382c4e9b

SHA256
60761bf8a97aedf14c46ccff39b9c264f3d7380d74787405d7622e880d2aa1f2

SHA512
b5668ddcc6bc51b11b7dc409cebe94fd9223b5612a2776ec7bb957f75d0ac4fa7d61ded5489673224ab62b0358742b7abcf54603173f9a7d9d9731ce5f3dbb62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aff01706621b6172d335a8f2eeec6ff

SHA1
678a4c6ac5a998eddc0774330f9953a8c64c70f4

SHA256
3a8d631195c7ebcfd5237ac406a2ae7ed1a948caf4009cfd4476d32d5807ab49

SHA512
54118b738ba7081b2037c764849c7f644cfb68df726f00be1c425bd5105cc96edb1b17a55dec7401898282d5bc1bec3847c259593224177c80c76d6a0123e27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d113f691f45cb57615a2f1d678cce1fc

SHA1
e715e2a692b4ed358ce23b2c1cf56f71691f5c99

SHA256
0cfc6e2b246a9fa217e898eb13934af92bb92e0db92e5b815af152b979e3c304

SHA512
4a234fca9f1c14acf8d7fcebedd4da21fb389da393d840e07c67010dc4de50a2ef5000aa5a3c43fd2e7c050dd916348a9fc785f5ffbe09afcf2f520a66a401b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7da4d5a5052f5b9ddd6346d3e9c2ed20

SHA1
4e3262816c4cb9f5cfddd355c5daf8395ebea5d6

SHA256
249ec0feb2d323f62b10bc6a688ed1ff95319de57da809d580d6fb927d49d145

SHA512
5544cd01ea84d2597ce0dca72a82a60f5714516c75bbade9356af1c87420f79dc4be646c0354aad2a06463e8cb36785cfa6b8ad44e178d2272687331c6cc4dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b754936def043ba98ae6be26f2fcd13a

SHA1
0bdd37879455c9149723b034400e0b9a28e25296

SHA256
49c9f7ae9ad6f64a02b75edb940ce4c75f3ba98d96849a3851f5e9829dc7d8f9

SHA512
91c7b7d189556d2aae16108781a6cec31f9ac368de40c634e089c171d094d66de9a3ea2e1e45a2a914a1c8752bb56a02bd506d3724974c6b5a32bd54c58e69f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d84c28efdc53cd24ab960c9a8c5658f

SHA1
10fe4d29c0bae908e2a2af68aef9e15df8c289c1

SHA256
5f98db02f4d48e3b60fccb5c212871f48074d44dfe5dfe94229ddc19fc40f287

SHA512
b01f26f7f91ff8c1b5218278cc3f6f1c724128769f37a6f34224229350ae12c5bddf06135e8ddcb10a8a0a8c4043047bebad0f268a821c65c3d55dbeecbc4f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7ee96d71feeae9695d75bea4bd7798

SHA1
6d5748977484e993f299acea2aeba8a230f42802

SHA256
3370e67ab02d6e16d3563dc095a173991e4361f8f423b0e514a9057b67caca47

SHA512
a7870e7477c0b93e6aff629a6ddf20686921f96c72e441f0f1cf1ff0e52a55479e96ccdc1664e0b8f7d1ac496f82621819bd3a599e3aea18ccd67cf712aedfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
217e970f85c23b9d0229e00f60465573

SHA1
5ba649f77c2d615d7e733a857f93463b12e4e91c

SHA256
78a0b61c46636c3233d449d9e23c90f80806476f48cfb082dcb3a9f63e04455d

SHA512
e17e508783cf475244cbbeb6aec2c852d2674ff8bd003d70762462f37d38daa084c78da1ac2b7e44204bf701620f8882f0123857e26eadfb7b58e1ab3e5fe81d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4897.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4946.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\WINDOWS\windows.exe

Filesize
232KB

MD5
664534f5a7d3363c583228a77a61f3c6

SHA1
b28737362098881bfa94af078af88141162cf959

SHA256
a1f5756a14729a3aa6b19a00db4b14763ef232a1dfb265994a4c2f9537b3420e

SHA512
fc2b9abc51abe3fb14c19b605f0a2c0c67686297f44b93a9c6660890b080c313af3775ad557ef23b411a55356f4bcf0d475304b70405e17e726191b5a57627bd

Download Submit
C:\system.exe

Filesize
232KB

MD5
783f0989603b944e855d2406ac875838

SHA1
0da9c8fc1a7369938d5b6f1aad7fd0fdf28ef2ea

SHA256
ae840ef244afc4b7b1a9dbaa23403611d66c917b16f12bcdade11c4f72dfbfea

SHA512
338b067fd4c8a15d3bd3cfbc96d3a5eb4de93693356ba95a57ef3e56543440e02754c83d9489accdffc7d0ca1aef419d3a6781c15c1a61fbb4340323b74ae8ef

Download Submit
memory/1620-444-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1620-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download