71a180a37b520cbb4b31d0adddbce0a760dace1a8c14ce7a15a6c1aa0365e790

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2b2007/行业贸易网站管理系统2007BTATE1/Html/news/20045/200452200525.html
Size

12KB
MD5

8dc983165e8b39f0d0c7175cbaf74a2c
SHA1

365dabc8ba0f9671c37026b3f0a7638da8998391
SHA256

90bb2cc032693f162226067d05ea2ed5a6f8150cca0ddba2d6989f5ef2ff5071
SHA512

491a79fad7ebda3dd9f36af8fc0e3aea697b211975737aec5d45de9f11a43de0fe140042a92b1cf335caf7a69b51c7a945ee28694214b8aa70b794003711ef41
SSDEEP

384:+Fv57uRkTFq+4CiGrYq/vZuBsEAeQCnj+X+qxUViy4PAP7KsQx7uvue:+l57uRIq+4CiGrYq/vZuBsxujLqxSiyX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000030284131027f8f86db90d1de079b211d2348447b036847fef1f29ec972910447000000000e8000000002000020000000e8e2b5a740f2085dbf38e7d071e07d8cc74106e709ce4bcee5d1ce1a9717ce3a90000000873c44d07eb1bab4f843c412f859a42f2fcc6bc4146e34ad617fc5df5ef64aee6f1ee395c49ebb77f9aab89e3c5d4e4f41e708343542a3b22337a94aede90256683cebe31d4dd30453ec5c868b60be0bfc2d112345f9acdf795fd9ad08d00a5b165e47e52ed63730fc2910f335ecb62b3f6bee815192957433d9f9e71258006dcf75ab1bc93087a82314a1e51c9833aa400000000d3a4f47b0724d564eb05257e3c6b48045e9c945c6681de0864317c9ad940f916a4b891df46682a3aadb0d1c34b8302692c59150601781bd3f6211e47d4a2fc0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{111F1FE1-5D86-11EF-9988-DE81EF03C4D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008ee207c90cf75556a3cbeb2228ed8d481e16751d71bb0fdf8fad9732d7eaad2c000000000e80000000020000200000001480f90981cc74e02ed7f82c6cbe6ee2609f6ca27dc97761a0dc4f2adb2ed54620000000207aba2ad7eff9d724f2ddc8ce303c9374028f70f6fc82414f53af1af43a027e4000000024c452bbe872f249a3fbb157e8f4ef7535491b7fbc28f52d2ec39f5be5592f01b1766b641fdf5a30d41fc2bad48db65e32ceaf21ca0e6acaf42d5c57c607d18a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000480ed92f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430163456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3060	3036	iexplore.exe	30
PID 3036 wrote to memory of 3060	3036	iexplore.exe	30
PID 3036 wrote to memory of 3060	3036	iexplore.exe	30
PID 3036 wrote to memory of 3060	3036	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2b2007\行业贸易网站管理系统2007BTATE1\Html\news\20045\200452200525.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9563fa03688bab6f06f8a5b9a5d2c5ea

SHA1
14fbbba0b5e95cbad3e4efe4a41b6ed15c00fbad

SHA256
7455901b57927d1835b8a53e0c3de642aa7dfe09e5b148ca43357eaa9e743a68

SHA512
bde5a6cbbdd9c6711645fb6ef2b72a7aa407ed467d4f27bcac70548ecb17886d2b31bdb63f75b232c319ae94c881e6a131c050645f98c2ecaa74fe9c8427028b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97711fcd03e1ae00e83edf9854bce155

SHA1
de4df02d5ab2650ffcb71e2a01bb264dead34722

SHA256
193917a98ac72bef2d8a7b97154977e13d64554c0096041c01660e2f9c266515

SHA512
8aebd5876207a364b3d7513ac5769343e765f80ecc8ec73cb957ab35c2c9964380c09408ad17f6e892e6b0d5f51923da2cce908a1ad1fde82dd92654a1673177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5bff3fd2c72d0ae98bbb3a15a508482

SHA1
deabe6f883b490edc0dfe70b9cd768850abcef2e

SHA256
2a76b73f70c15a2cb35acf7d340ba4e7fa43ee0e415f58bf5c355a7038d4d554

SHA512
169e836707f1241b4e288c12178f37a072f2203acfb9dc5016eaf62338a1e6c8f189cdb9e80d1df53061a016b5cbb563a8d5ec42e350720e02a19514651015f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
689fac9ff009c2f391f59c803e42d4bf

SHA1
289681b0837044098325abaa21e0f2191c26c0f6

SHA256
e1c24ef6ca7c461d177dc17f2388c7e9648f46712c76de0d8695b4e27174d530

SHA512
b935a6e50659b622accc30cba9274636865d289cd2b1dc66fab46b80ebd95af0cedf1c3b64a293f233b9627af94bcb3c1eb6e157c6c4d2159a8a8ad660fe9478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c208ae37b62e70e31278c7b628915270

SHA1
bd4373838343fab2b5576cf8475e35c37ad644fc

SHA256
9cccd96bf1088c44c5b89887bdb2364f1b5a2746a7b52590ba750e904df6a53e

SHA512
14b12d127b9193337ee30d406a60851bbc548c99518df6e30c258562d352b4d343b06415634b072578e5f15439bb5462ecfa0870c3f5bb15a2a7084e865360ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a78a72677813e9a61390a2e28640bda

SHA1
c68ca73b7be3c995ec5b625d61b088588dbb4887

SHA256
0b8726e1451923151925e34fb5f045379477ad6625df865d5d682fd04cecf866

SHA512
1a67e01c04ee25a9cc523f710278a7813679d9318004d53297e2e01654e7900c7d29356009bd9e1e330737ee23e095690ebefcc296e7870efcb66b8e34c28f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb4cf5ae96ddca9bd827642d28140b55

SHA1
7da45bbaba75d3b5d5acfb78c4027628f96d9866

SHA256
24cfe006b3cda82a8b8b66203f99ee0fbe2d5a28c67479fa9bed288075269f8e

SHA512
7cd301f39d2628aa0e90b83110da3ab69ab25a80ee9b99deee7ffd2db2b569c01bbe64ea768ddcbdde25bca823d20ccc162785d1d997ef45541e093cd231f661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f942539384167de64ba2e1e1565006c

SHA1
1117955a6b69e230b78e319764bbb633796442cc

SHA256
ca6f6d184ceed2d9a4044de56f8c5cf6dc94c7d27400772d620b18b0dc745ca1

SHA512
995a80bdf87b19678c9d9448f8a081586237a68ae39978b0a343e4e6c0ad3cdc2b76314110381a375bf748e1176df6d3df4514b0e92b0838bf290584521430c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0049993e486f5e54df06ecb59adb242f

SHA1
0ee3ef2844865cab960783e09229605a24b22846

SHA256
7bab0520238e6d0ca1eee86b033ccb123c36736fe6ab03f33df087f02a7bc632

SHA512
46498368bb62b0e76ac11b0bb155ccfd87f7ef5d66a8a3f5761526b9b9f2ed440e7a9dcbbbfd22f3ce1e46e22d8d4e2317a1a77893644b39a07ffe55830afb04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18460763446f6aa4fff126c801f39f97

SHA1
15ea3083a4fd27deff798961d1382f01f240152c

SHA256
a1fb930b38825ecfa6a7ac3f249c6fc2e1acc7e1415fb925cfa8383bc61e8c88

SHA512
aaf6bfdd8a029a2a928f41eb5e66f639e0beeb4be1ad9d35802f3c94651e3794dc90c8570bfcd71cfe910b01ba409c3da96fb441c719ab0d7f513b656955c622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9220b658a7cdfd18dddd2b9b31adaf38

SHA1
3472c9f435deb61a72a47eeba2181371156ec482

SHA256
256617b2080266e56cbfc0383bbe022b8f43b16a2cc1ffb822df13742586ead3

SHA512
3f3aa3cf4300ec55dbc777955d9ae28ddb5b3a99bfba9746ff839e987344840a86d927db3f8e29886ffe4c845b208b4b09bad3256f861bb921b2de95427ac44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2e92589ad1c359800aca291342c843d

SHA1
2e088e8d85a527c224cdaa64fda230dd6bca12ad

SHA256
ec8da5891dba0ce00da22e8bf097ea3ebfef73162dcb59dc537244103f83f580

SHA512
92fcb26861b9c480f28a41e3b3b385029ff9753600a59ca60d8a218545f8b50aaf4bd31ef8d88821d787b23e995a9c3ff108222477b50e9756eff5ff3dc34f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f501cfdef76bdb520efc104d925cc78c

SHA1
3fb39e4574abc4f21ed3209303a43231ffa50d96

SHA256
65ec6a6a2f634186afec88833b34c0fae7779d540e10e05277141ccc45dca400

SHA512
771f3d149137a349c26ce7e3db4acc1a0794d2e083a778fa63a6ed1a7c7e8bf9a30e6feef5a4055603c1825f9cf4586918b5999c1e1a2e31828aea240e7b58d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit