409f0443ee369d79d861b78cd491936f3934d12518465ec8007131aae5b922d1

Analysis

max time kernel
66s
max time network
67s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d09b39e3434f740cbf742bc6c36dd00N.exe
Size

232KB
MD5

8d09b39e3434f740cbf742bc6c36dd00
SHA1

6c98931c739813fab1902dd4d4236cfe8498fc71
SHA256

409f0443ee369d79d861b78cd491936f3934d12518465ec8007131aae5b922d1
SHA512

6e542f0c9dfc7c23c5fe14d573adea43ac32d7cf40386e67a8d9076dfc5a3c2981e66d6c5ebbad41fe2bd3c52f35635903936977a5cf7868d3048006acbf27e0
SSDEEP

3072:r1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ji/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	8d09b39e3434f740cbf742bc6c36dd00N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	8d09b39e3434f740cbf742bc6c36dd00N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2092-1-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x0008000000016d2a-10.dat	upx
behavioral1/files/0x0008000000016d32-11.dat	upx
behavioral1/memory/2092-444-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	8d09b39e3434f740cbf742bc6c36dd00N.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	8d09b39e3434f740cbf742bc6c36dd00N.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	cmd.exe
2600	cmd.exe
2672	cmd.exe
2196	cmd.exe
2164	cmd.exe
1292	cmd.exe
1072	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	8d09b39e3434f740cbf742bc6c36dd00N.exe
File opened for modification	C:\WINDOWS\windows.exe	8d09b39e3434f740cbf742bc6c36dd00N.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d09b39e3434f740cbf742bc6c36dd00N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0156f7ba0e8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429179724"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A43214F1-5493-11EF-B161-F296DB73ED53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	8d09b39e3434f740cbf742bc6c36dd00N.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000021c193c0aecf833c5891ba5095e04c9ceba7d721e877d15bf84d30ae29dd98aa000000000e80000000020000200000000cce835a5c9402af8d5b80ed0bd1ff23808788d19aec1abada8117e79ff4532e200000003047c59128541115d7dd054620b8a1e9bba4fbb7f4901d142cc6c79bae86fe9d40000000a601514f9ae734910bc91d01fea6d3e6054fa87f9fb79756234d70edcf0592e5b5e9be29a7c3b44f3db73b7e742852569fb605dcf36230702b849494a47b7ea5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000cfd9e076d3968e0f1407fec8329ca173949bd7df6882a1fd44c9e1d8d68ebd07000000000e8000000002000020000000f544a37a8f30b5cf856e508ccd1296ea33349ae5e25c530b0749801fd81d8b509000000024d9aaf9619fefdf061160e1871819de7c09e0bff064c40a90bc9968475be35873fd642349cbafddc1cf32890e170016c4d7e3c81d716eaaed7f448fe887891e9c676f6721bc7faf58f82ada5e35efc259cc6824df2d2a4eca38d50e59b9bf20272a878ae6020cb651ed5bf922cf67732b8fb32ee25e21d1cb12ad00e3fcfac6d59049039e6a22fd2a9afaf9c6f76c55400000005af8d5c035635ea93ab882d7f7f42ee6cfe8ca491e01066de7bd8a5315d8cc732752b78ddd3e0277fe9613c0d2433ab2829f7e814f386ead3e472b80a345a4a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	8d09b39e3434f740cbf742bc6c36dd00N.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2092	8d09b39e3434f740cbf742bc6c36dd00N.exe
2816	iexplore.exe
2816	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2816	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	30
PID 2092 wrote to memory of 2816	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	30
PID 2092 wrote to memory of 2816	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	30
PID 2092 wrote to memory of 2816	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	30
PID 2816 wrote to memory of 2844	2816	iexplore.exe	31
PID 2816 wrote to memory of 2844	2816	iexplore.exe	31
PID 2816 wrote to memory of 2844	2816	iexplore.exe	31
PID 2816 wrote to memory of 2844	2816	iexplore.exe	31
PID 2092 wrote to memory of 2700	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	32
PID 2092 wrote to memory of 2700	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	32
PID 2092 wrote to memory of 2700	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	32
PID 2092 wrote to memory of 2700	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	32
PID 2700 wrote to memory of 2656	2700	cmd.exe	34
PID 2700 wrote to memory of 2656	2700	cmd.exe	34
PID 2700 wrote to memory of 2656	2700	cmd.exe	34
PID 2700 wrote to memory of 2656	2700	cmd.exe	34
PID 2092 wrote to memory of 2600	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	35
PID 2092 wrote to memory of 2600	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	35
PID 2092 wrote to memory of 2600	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	35
PID 2092 wrote to memory of 2600	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	35
PID 2600 wrote to memory of 2648	2600	cmd.exe	37
PID 2600 wrote to memory of 2648	2600	cmd.exe	37
PID 2600 wrote to memory of 2648	2600	cmd.exe	37
PID 2600 wrote to memory of 2648	2600	cmd.exe	37
PID 2092 wrote to memory of 2672	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	38
PID 2092 wrote to memory of 2672	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	38
PID 2092 wrote to memory of 2672	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	38
PID 2092 wrote to memory of 2672	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	38
PID 2672 wrote to memory of 3036	2672	cmd.exe	40
PID 2672 wrote to memory of 3036	2672	cmd.exe	40
PID 2672 wrote to memory of 3036	2672	cmd.exe	40
PID 2672 wrote to memory of 3036	2672	cmd.exe	40
PID 2092 wrote to memory of 2196	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	41
PID 2092 wrote to memory of 2196	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	41
PID 2092 wrote to memory of 2196	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	41
PID 2092 wrote to memory of 2196	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	41
PID 2196 wrote to memory of 1848	2196	cmd.exe	43
PID 2196 wrote to memory of 1848	2196	cmd.exe	43
PID 2196 wrote to memory of 1848	2196	cmd.exe	43
PID 2196 wrote to memory of 1848	2196	cmd.exe	43
PID 2092 wrote to memory of 2164	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	44
PID 2092 wrote to memory of 2164	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	44
PID 2092 wrote to memory of 2164	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	44
PID 2092 wrote to memory of 2164	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	44
PID 2164 wrote to memory of 2492	2164	cmd.exe	46
PID 2164 wrote to memory of 2492	2164	cmd.exe	46
PID 2164 wrote to memory of 2492	2164	cmd.exe	46
PID 2164 wrote to memory of 2492	2164	cmd.exe	46
PID 2092 wrote to memory of 1292	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	47
PID 2092 wrote to memory of 1292	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	47
PID 2092 wrote to memory of 1292	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	47
PID 2092 wrote to memory of 1292	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	47
PID 1292 wrote to memory of 264	1292	cmd.exe	49
PID 1292 wrote to memory of 264	1292	cmd.exe	49
PID 1292 wrote to memory of 264	1292	cmd.exe	49
PID 1292 wrote to memory of 264	1292	cmd.exe	49
PID 2092 wrote to memory of 1072	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	50
PID 2092 wrote to memory of 1072	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	50
PID 2092 wrote to memory of 1072	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	50
PID 2092 wrote to memory of 1072	2092	8d09b39e3434f740cbf742bc6c36dd00N.exe	50
PID 1072 wrote to memory of 708	1072	cmd.exe	52
PID 1072 wrote to memory of 708	1072	cmd.exe	52
PID 1072 wrote to memory of 708	1072	cmd.exe	52
PID 1072 wrote to memory of 708	1072	cmd.exe	52

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2648	attrib.exe
3036	attrib.exe
1848	attrib.exe
2492	attrib.exe
264	attrib.exe
708	attrib.exe
2656	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8d09b39e3434f740cbf742bc6c36dd00N.exe
"C:\Users\Admin\AppData\Local\Temp\8d09b39e3434f740cbf742bc6c36dd00N.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2e30ca03021ce2303c46dca895a85150

SHA1
5c9d766079fcb864d32ad9ddc3e64f82f7c041a5

SHA256
c0030ad45f18b0c02f172d8de82101c4d781daaf95aebe09fb51cd2832c75b61

SHA512
e2ccb5b3f30c49b0edae192eff508f335f6577900030b2f9504735c95fb0d458cdf9db2ad2d55c492c744e00f1ef802a0293df5de8803d00304f68a73cb251c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c28f5ddba71ca0f88c6113b85a8ee544

SHA1
c5c1825acec7da5244bc992750a5969abfbebde2

SHA256
b0a2e6041b7a93e0fa85049ef8dab7adc3da4e0d56f276b24a5d6850d5729201

SHA512
aadff1aae45ee1be0fc08237d38468f046bc147eedf6ba72149e29cf6abd4c9100d2671fbdaf24fc785e5a7a782eb12292e17ff5a23fcdbe3c58c7e8329a955f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
14dc61429fa3249cead4c372c5c6964e

SHA1
9dcc7576573730dac5ca1fe93c64c011033d67d1

SHA256
bb4deca3daa1ccb9c8a74d951a241caac9470285be85e31f4fbfe36f14291a6f

SHA512
f9566577042736a94f54877fe6c142fa4741bb6535c27362298d1c9778f21740182cf790967779e4e8deb6eaeef685dc5a027881b5b923bd374224436365dabe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4dedb76dd2bde70250333faf0e3d5f5

SHA1
3a69b530a70f29279eea600661a593780f510c92

SHA256
bf574942fc5b1c0622046046b70090894728e17d5de28376919c3a7da510733f

SHA512
7b236ac1acdc9e049fd0149d477d0394c032f84c7a058f2e44424816a3837b0efb61bf3105b117c235a89f6373f4214ca154905b6cf285ecf236bd3d95391be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a1d91443f4048c937c3a82219854b337

SHA1
c63f44ed8d305ca9dc3bc27824a2c27d9cb2cf32

SHA256
bcf22753652ab566b195b09fc655e3b8c3af75ce9f738f38b3611ecb1b80a363

SHA512
caaf28d72583f2b242455a698acf5b3b05605dcc4b66273a5379c350991cba41935bbd7c37022defe95caa0da4f148322dcadcbf5e9c5e2230c51221ef828854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
50024fd449d5f5f482831a8048758f67

SHA1
054bec2a16f5da32331c00f57d7e3d0b816f0128

SHA256
1e7025a3db5977dd639cd8f7dfe712a9bbcc619c36b42c434f6d4623cf02f0a5

SHA512
47b1d82708a5b43627c8fff5b8a228f64a3f71c33d94a1de01eda7a269d52b0cca85b6a8bf0c996dd05c9a63c094bdfd297eb9ae884accc15587abf018e1fee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4c04ea4b576030d13b79506830e25705

SHA1
fb1e215a44b097b9b606539298742af0e4e53f2f

SHA256
ba5fa35be7b4f4922d3aad9934d1b1f0743e81042cbf6c715bf2c4d224e46fe5

SHA512
f71836e98eae652d971ebf182418898f6862e6adebab43a9b263483db8feabc1d248c78090a074330956bb5e6a97623a1def6d54c1512f2c0d3987ca2a451f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
594bbd4495d85be4662e2478cfcc2c63

SHA1
da8a86ac71211287092e26c54f34c78628cb885d

SHA256
40a1deb97d3b99bf139e04bb598c5ca0bd2a8b24864514e921472d30bf639b64

SHA512
1888c757257aaaa2419eb6d98bb9fc22e3ea9951aad42bd2011e24b38351e802aaeabceecd746f0f10421a32a967d3d60d94f445553f527d6dc8648f358dddd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb986310e4ad29d9bed18cd02c47c674

SHA1
29b99757382398c235880a3fec704af5d7fb34d8

SHA256
735f68ecc7f09254fc111d7e9958b5f72efa8bbd598b11aaa0ee01221be6d0b4

SHA512
74e6d79d4f684bd2ab00b85ba8338ee835285c58acb74fdf4bb744d9bfc18581abbfdbab2ea585817ccbacebe9358cd879941a2cf484c68fee03a3040de2ba67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f8bc09f0134b4b2013d441a863b7392c

SHA1
4309a131d204852ee1cab39455c1006b1d7532d0

SHA256
b8f95b4310f063c98a5c12882d6bc84b063e0c38ae76371b697f8d51aa3fcdfa

SHA512
48f2dc13f99fcfa085919393077d395b4967ad457fbfb3b6a1e072a7b369c8c5bf6ab0ec58e753bf2bb1d3798311a916358f4960d29a0deb6937ebea86155e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6042214963d3239499b03663a505569b

SHA1
ae15dcb22ea9d5f2ed643e4f40e859206db7c0bd

SHA256
83bd0f4ca41500bcb942b2415649b7da0d3b93c0a0401a0c22eb74af9d462cf5

SHA512
52bb13895fdf612c5f2519c591439af11ace56db4c2693fbf82cfbb4ff93c7f4244f428238f5e947b96635dd452cde5c8ce668afb4611d0c006e387b828201da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f560dd1683f687a638648ff9ef98eb6d

SHA1
e75fe009a82dc3dad07a1066f6b3ac9516713ac0

SHA256
ead7bcad6f58dbeb95341fc63696c164110d62ad77b609f147539a2f110f3d4e

SHA512
501de3f2b822c58202cd0982e85967fc2a2dd888f3112095e087dc2564da86700c7d4eedcb0f7687fb49f763c46cebad744d6447b75e509631b156b0dca3890b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f4c5d778babc3c3020fbdeab473b03c

SHA1
e3350dbc5d27e17f77be2792cce8e9aa957f893e

SHA256
a7149ef532e463cefa18c1e1512aabda3900f5f9e4e69f34b585729167bb0563

SHA512
8c333aadc9311dd501cc22adb68a127380f8a816e69f7899c2bc2be787b1b8de579d381d2c491cdc8794082c011571c77763c9ab764add33e55655cbadd51eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
26d68e895fe3fd5abaebc5b303d0304e

SHA1
743ef421c1c09c9f944b11243ae0e0ae71d7d156

SHA256
603cc2c33d19c891d096e1cbbde637ff32eb6f43b6dc0a53a037e7ab06a4c29e

SHA512
41e5554482681f27be8fdb28fd8888475686c56fb5906c4bf103c2f619885bc999fd4fd9d3fa995514df7711f5a0f4c1eee4b4bcf85f5b1c1c1d8bf325d10e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
40878c14935b0a5393c7b3c277a78593

SHA1
ff22fb7dfa44bb928743fd98d6135fcf857b8fb6

SHA256
ab8d88377398018d504ab60e9136edc2ab97a24d00db96a16e32afa6f457395c

SHA512
658c82098d3b9cb375a4c6b381eefa27010d7a4c1a99ef36a8b83438db86d04b9ae8506f857906e27489679a1028a5bf1ab5b439944ab2c53475a3405d9eddf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b95e9dff561b36668e387d906ecc0325

SHA1
77f53a654f28a8b337510f7bf68a3ac2e13f508f

SHA256
e221539e90e8bbaf9a625c659dfa352e1ebfbc33c5a04fbb4628105a1f5ed1ec

SHA512
98a890f0bae4b448c3275d508969c6cc52c34e69ced1f516df7c1a0d591fb90867b6d59e707ab40dd46554ae405537915d7e05169378df539ec731f8946ab840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
41cc0e69d80cf70762ca6c17b8672250

SHA1
c768fda750bea7fbb6871df51abedf34ce2974ae

SHA256
6151fb3b976b32855f00b784daf800b0b762c532859ca6521d3f9881ce6fa338

SHA512
c2044eddd969f827e9a41b38e5903a12ff8e908d5b18c586963e375c2228cf145600ca84be8de7f44ab6646cd544647e9a4d89577afd55f3005880d3a42836da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
43e42276af9bbed53d7466e995c55cf7

SHA1
f1078ef06abbe5f8d9908967522565d7036416ec

SHA256
28986024c9ff7e0eae7610fdceb2af3b42029faeedd19d8da32b2b7f941e8534

SHA512
9e2f3d82a88c151edb37d313a4e8b1f940a4ba757a8000af5278af057204d6e508283b4234f168b2cca959d07243f23d4a8cd7cd2cc296e58c2ccd4f6a022722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0c4534b7f8df7dab83d25a2ff76f85f4

SHA1
d481afb8a23236ba13ed59accaf557fbda2d8159

SHA256
a35b20776672bad8a04199397c00491f00dab73aadbd3ec48fda2503ee3b7058

SHA512
a0b196fefdf1793739ddf9b005612806c387c984ae7b119afcbe8a57cec88a2efa7937fc6b2230f5aefc4cba4e26023d8c0e712083039bbc4b7da56045072b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce9b7ebe0013bb0cd33500f181d0f854

SHA1
5dffb01ef894e707ff8cc515128b5037cd1ed94a

SHA256
916009a8b387941d6e3a61ab32ceea3a16f588b1ae6b24a1ec2cfa3cadc6e6d9

SHA512
984f34a6a81d8847827dcb5f01b23bcefb02883ff63a86ff4471f8ae2bbebfb4fc85f92c9340da84d0ef82c84fe3f1bd09050526affba28b80d06119d61e83d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA122.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\WINDOWS\windows.exe

Filesize
232KB

MD5
84ff94997c65eac727aea52ec8e1b6a0

SHA1
eed1d9a7d1272bd1f70f7e91c2645f61cab527fb

SHA256
b9c6a61d397648b4844b5acbbd123eb2ae1f2ad9b2145c2840cc2504f2b499e3

SHA512
0a1f734b69959e4ec8a24ce1f61b5409f5ea47990b12b438c07f1518dfab6dd1de4a4b798522d74850ca190b0617ce46993b7c35a5065c37de92cc128baf0b5c

Download Submit
C:\system.exe

Filesize
232KB

MD5
079b2f3e556b9068f85ea1944492c8e0

SHA1
095c7d3596e052cbfe9c8c185d1075109346f2db

SHA256
200c6689268bebcf5334ad979990398d883447b4525003a7f805dc2d39715d3d

SHA512
365963168034f0dab331d12aea12d6341dae7000a91ab781f54784fb023c4ebd416d05f663258f53842cccd69f0beef6816362c8e59be0011866b0b6bbe29b9f

Download Submit
memory/2092-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2092-444-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download