d035a83631ff9fae8a28d6c8ccde53fe8ad4ad621cc9f93d467c802a4a9661de

Analysis

max time kernel
66s
max time network
68s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b062f5265d63af3c9ccc1eea4adc00N.exe
Size

232KB
MD5

30b062f5265d63af3c9ccc1eea4adc00
SHA1

694f3a72628cae050886c28e25ccb8431e0d16b9
SHA256

d035a83631ff9fae8a28d6c8ccde53fe8ad4ad621cc9f93d467c802a4a9661de
SHA512

3c9ecf614e88d7b741987f6c0a40d106cec47b53c678ee73123f067d368013081772b937426d71ecdbed19261fab5ff25aff032b8920f71471cca257a5290266
SSDEEP

3072:L1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:pi/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	30b062f5265d63af3c9ccc1eea4adc00N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	30b062f5265d63af3c9ccc1eea4adc00N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2452-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000800000001743a-10.dat	upx
behavioral1/files/0x000900000001747d-11.dat	upx
behavioral1/memory/2452-16-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	30b062f5265d63af3c9ccc1eea4adc00N.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	30b062f5265d63af3c9ccc1eea4adc00N.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2852	cmd.exe
2708	cmd.exe
2628	cmd.exe
2724	cmd.exe
2844	cmd.exe
2604	cmd.exe
2208	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	30b062f5265d63af3c9ccc1eea4adc00N.exe
File opened for modification	C:\WINDOWS\windows.exe	30b062f5265d63af3c9ccc1eea4adc00N.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30b062f5265d63af3c9ccc1eea4adc00N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000bcbb07a8ce8df43582a9e036ed6cca6ce90d3295bd945b51fe2c97eb3067209c000000000e8000000002000020000000195fa5f12c9e1feba44c0b6a77513a4aef8d46c1cae7d7b846c2c963c8e3ba889000000033bec6c5246b3fe16596bb5ea0ea9030ffabde59b194f2d66ab4fcc59cdf05135a36e90d7964115c490d941f7f870d7762d2359c7f31709d5c727bbb7d14d8ceef598d21025b999540423ad6224f16780acf0fedb3dc4b9645c53ab187c04b32240192b2bde9c92c2b261805fdf0c63cd29527142fadb102ad5f1a161b86a82a7d6c03915766a631325cb1ac4081f2db40000000d76cfe699d6ad78cae72ad0648cac60727f69bb8a20f4f67eae639c903d6d9519db7225e088a90259b844c47deaeca35cca914b7321d84930998a530b8ff4634	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431521668"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ad8f442b240cf5f952b9f7d71d8353000b853f0194f035e14b754630f1da2693000000000e800000000200002000000042e6d8d74f4f67f9700b53569617022f9152b20851e03d88f025fc111b4a1985200000000a1cd73671fd3c675b94ab1d1c29111d214bebab9ea7dc58bc67c323df2a5bdc40000000bb9cdeb7392b31b4a8d04b3f62064b8aebe2b7c17a762ac735020b90b211a0d164848dc83b8d2cc340dedac28bc205454ce6a4d8561bec5e21f33b5b522a138b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e97240edfdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{679A58B1-69E0-11EF-8C40-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	30b062f5265d63af3c9ccc1eea4adc00N.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	30b062f5265d63af3c9ccc1eea4adc00N.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2452	30b062f5265d63af3c9ccc1eea4adc00N.exe
2352	iexplore.exe
2352	iexplore.exe
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2352	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	30
PID 2452 wrote to memory of 2352	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	30
PID 2452 wrote to memory of 2352	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	30
PID 2452 wrote to memory of 2352	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	30
PID 2352 wrote to memory of 1232	2352	iexplore.exe	31
PID 2352 wrote to memory of 1232	2352	iexplore.exe	31
PID 2352 wrote to memory of 1232	2352	iexplore.exe	31
PID 2352 wrote to memory of 1232	2352	iexplore.exe	31
PID 2452 wrote to memory of 2724	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	32
PID 2452 wrote to memory of 2724	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	32
PID 2452 wrote to memory of 2724	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	32
PID 2452 wrote to memory of 2724	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	32
PID 2724 wrote to memory of 2800	2724	cmd.exe	34
PID 2724 wrote to memory of 2800	2724	cmd.exe	34
PID 2724 wrote to memory of 2800	2724	cmd.exe	34
PID 2724 wrote to memory of 2800	2724	cmd.exe	34
PID 2452 wrote to memory of 2844	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	35
PID 2452 wrote to memory of 2844	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	35
PID 2452 wrote to memory of 2844	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	35
PID 2452 wrote to memory of 2844	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	35
PID 2844 wrote to memory of 2744	2844	cmd.exe	37
PID 2844 wrote to memory of 2744	2844	cmd.exe	37
PID 2844 wrote to memory of 2744	2844	cmd.exe	37
PID 2844 wrote to memory of 2744	2844	cmd.exe	37
PID 2452 wrote to memory of 2604	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	38
PID 2452 wrote to memory of 2604	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	38
PID 2452 wrote to memory of 2604	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	38
PID 2452 wrote to memory of 2604	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	38
PID 2604 wrote to memory of 2872	2604	cmd.exe	40
PID 2604 wrote to memory of 2872	2604	cmd.exe	40
PID 2604 wrote to memory of 2872	2604	cmd.exe	40
PID 2604 wrote to memory of 2872	2604	cmd.exe	40
PID 2452 wrote to memory of 2208	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	41
PID 2452 wrote to memory of 2208	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	41
PID 2452 wrote to memory of 2208	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	41
PID 2452 wrote to memory of 2208	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	41
PID 2208 wrote to memory of 2624	2208	cmd.exe	43
PID 2208 wrote to memory of 2624	2208	cmd.exe	43
PID 2208 wrote to memory of 2624	2208	cmd.exe	43
PID 2208 wrote to memory of 2624	2208	cmd.exe	43
PID 2452 wrote to memory of 2852	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	44
PID 2452 wrote to memory of 2852	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	44
PID 2452 wrote to memory of 2852	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	44
PID 2452 wrote to memory of 2852	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	44
PID 2852 wrote to memory of 2824	2852	cmd.exe	46
PID 2852 wrote to memory of 2824	2852	cmd.exe	46
PID 2852 wrote to memory of 2824	2852	cmd.exe	46
PID 2852 wrote to memory of 2824	2852	cmd.exe	46
PID 2452 wrote to memory of 2708	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	47
PID 2452 wrote to memory of 2708	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	47
PID 2452 wrote to memory of 2708	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	47
PID 2452 wrote to memory of 2708	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	47
PID 2708 wrote to memory of 2592	2708	cmd.exe	49
PID 2708 wrote to memory of 2592	2708	cmd.exe	49
PID 2708 wrote to memory of 2592	2708	cmd.exe	49
PID 2708 wrote to memory of 2592	2708	cmd.exe	49
PID 2452 wrote to memory of 2628	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	50
PID 2452 wrote to memory of 2628	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	50
PID 2452 wrote to memory of 2628	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	50
PID 2452 wrote to memory of 2628	2452	30b062f5265d63af3c9ccc1eea4adc00N.exe	50
PID 2628 wrote to memory of 1328	2628	cmd.exe	52
PID 2628 wrote to memory of 1328	2628	cmd.exe	52
PID 2628 wrote to memory of 1328	2628	cmd.exe	52
PID 2628 wrote to memory of 1328	2628	cmd.exe	52

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2624	attrib.exe
2824	attrib.exe
2592	attrib.exe
1328	attrib.exe
2800	attrib.exe
2744	attrib.exe
2872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\30b062f5265d63af3c9ccc1eea4adc00N.exe
"C:\Users\Admin\AppData\Local\Temp\30b062f5265d63af3c9ccc1eea4adc00N.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ec36dc9a83fc5990e5fa33efcc74457

SHA1
1cbd4013bb0e27753eb3db11643ac6e1b2773ca6

SHA256
8995377ece94ef22446f82700d13d14a0846eca9a8fec3200e2bddff5e5a500d

SHA512
2ffeb49605b9c61f4b2f2ce92d66a7e323f244820f8cc1493143d9dcfe9ebbe71a080d80b29943f456e3c199f1755cc84f8cb6c425a97c1d9e0d5cfc4a450dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7e6130740d9e8139454d93d0d9a3f5a

SHA1
898bba7ced27e07c739484518134ae05cf419ee7

SHA256
f86a89b905311d1721e310d11382d9de142dceff44c75b39f80de798f306c147

SHA512
e21c88f2253e54e09852b2c0586461134a520f821523016a679ffe6552481d2a8cb2f9d649b8c7a6678f73ccaf957a4fdce848edfe1e7072f62fc2556f30ad92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5ca6c4ec2d7545606cba0562260403d

SHA1
2a339dd54e1f63700da0d174b486917040a03b9a

SHA256
5d31beb2f662723022897bfdbe8ff1fa427d48a9dc11548a7a6a23662f1d0254

SHA512
9e9a78cd39f784602fd3c1e7101777ac38604736f3ddfd3a81f55118bd1ccd82361150018ac4bee2078cb63a5f702fc7e854d8d20b1f8fe54dce84f318eedd79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73a2c06b6ea6ec841f0c52d9794e7219

SHA1
c0fd46682c11f664fd8815cdec6f0e4627b2b197

SHA256
0ef24e579d3e7dae9f21c062d50bb7548eb128452f430caf4fafda3c961fc9ca

SHA512
edfc8f645ffe92281debfea30afa4f51c23f0ffe424721a780e13f0b8956d71eb083194998b80b4157575e30b32ad31fa8e18ef222c9b40f322265fcb2a8918a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eadc09d3f880e257c063d1f0ab07126

SHA1
1b82078f2d8b7dad8f3b852176c7b5fb336f4ac5

SHA256
6733672168e9fc27bb74d23067c2925be847088d9854a61d1a6650d54237b12f

SHA512
e57690ea4c448bec590bd20cd56c4e488f9b3d8d2472632c0b5eda4ee4f0c29282edf2679a98efcfa1cad781013578dca16a0576f0c8eeaaa4429aa24b858f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a2f167ee287cdf571fcb7c33a66d2f4

SHA1
a5685e01f7068ea04655a755c35fc7bbbe97ca15

SHA256
240ef6d0889d25a721943069c8281f451fab694ba128442378af3d9488b0b0b9

SHA512
2a6c80a6787673d821fb5190e9f5a80b51be7809525c607d56441197590619012f6851ece5a3f0e740809807a6383422c3d4b98f99e32bf8b4a60b79801604aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bfdf9b354bfe1835bdc3eacadfb894f

SHA1
8cee4c4b5c4294053ce8c0d044e4939d14c6e311

SHA256
f7d495f1fd7668ce979e16fa0d61fffdd3a8a8099c2088ec87259bbcee964d55

SHA512
6aea8cc22c699883e61e65e0171cde8983b62b5be4a628777361f1255ee6d9600890751f8c04b83e3fdd436f27b25288e45c69a8392479707183125237726fb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ccb4c08358359d17880fdfaedea1bce

SHA1
627fcaf3ca520496475c2eb86001517b9574d235

SHA256
cdb0610ea4b54eb11b1bb1906813b5b2524443885cbe7b6116b47284ece5b538

SHA512
06fcf022420379206b40aa63194e48261ed2c0c3c6bbf390516859e9723b017ab0eca9830a3187b2d98ab7e1c277c1947987517e938d41b86cede9d3e51d0009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d64185f7e2af031ebc88bbdc4b152775

SHA1
3e8fc7941457ae632949dc5349df1561500d689f

SHA256
35432d3dac06689b17a01539422e628fe4bee075bea67b9f88493649626b7f93

SHA512
494d34da6497678cad4cd4b9e26d526e4171436cfb4d1cd826c6c1da2ec697beb292d6d0ac3bde54fc63972e99ce678c4138ff0e0236fa2a0c4d5ee28f7fef1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6954d2760d87aa6c9ff9de2f9442433

SHA1
a6d5957f1d00065137dedb9497627f5ca8aa0768

SHA256
68e02332e0ced9277ad0a182653097a1f6df26ccb516e7c2d3c4d456d56a753a

SHA512
d616312e8c9ada0ea01f5f0415c1f2f0e31fa832b0c1d36049be71a3880f9e05e0b47facd514e07ea73dc2904d8e44c5e6ac894801aaa0dea87d394035285d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6977051574cb444d676d02bba340d68

SHA1
2c2f2f8d9dfd1f400fe554a996bba21d6f462a85

SHA256
47b66ae436ae51e743f5c9c5fb59ad4b38386cbad9995a0d3a5dbf79e38c6ef9

SHA512
20ed3f59db6cda969ad9b12e9d63fd2bffe675746516ac69b0c127423b9e73f763915f3e5bda43768b1cf667ae4eeac6b95bc3507420a5b3a1c3737f623e00dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cca70d0f7cd3d77cabec7225e4984edd

SHA1
3538d1095f4938f7c20b98b152a74acc920bc8c0

SHA256
d88aeed69ded1d3e4b0f438f4a94f2799381b092d0a96a95c8713e685a24fd4c

SHA512
3f82ec8724a86535991556ad3cd8af9673724ee040114d0735390d66f908c48bfa274f418f94ca871d816cf9801cb48d448a275da58677faade3862d5bebfaf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fc46e18868e0e464fe825af55ed744b

SHA1
8567d7cf7408c19b3851473cf3593db021248b77

SHA256
0aa2a3cba99b7b9dc942b0d4c7d17dccee642183a6aed866a498e7c876d68747

SHA512
0a5ed1fc16b8735a0358d82f7ccd3fefd57dd75ec71c8f77d5dae584c0b57769b9c3316c209364cf19430e3d2bcc1edf2e1f35b2dd94f4fac878fa2735a013b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95bb7db433adb7c018ba610f3bf4d674

SHA1
09d6e651efeb8d179a6ac8cecad552842318ec32

SHA256
80442c014ac749ee3b1e8eddd747ba28cb8154997569f19131b888de2d2d0e06

SHA512
26f290da7637fa2183c20ca361db488e2ba0d7db94a1c4d67c3e8587047f48d8fe793eafab0260013687d254b7572cd42e6fd954f0d6885fdcf0a552a24a319f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c0b36b573477fd1e8f066d7b8d4b33f

SHA1
d689b2e083352acbb75f5ed38d94fd7b30c4cc9b

SHA256
28c78fa95b1ed1fe9a2e61e2081a1be3d0ba23ed9af7094d34340eaaa1f8ff13

SHA512
8a6a98cdbcb03ec476589d395167d764156814c619e5fda87fe868142a4cea33ccd62a5bacf1a924c89b4173bbff3a1cc9cb64be27ddbd86371c02a7c5c87a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cc7ff8172fa69059a0c14879f25a547

SHA1
45e8e0813d523087659cf17d1e5ca0261466513a

SHA256
bc11fce3d84eae9b983eceb3413293e490ee02bc34d69b26100eaf0ec279dabb

SHA512
fb47655bc36e31d5c9ef357b7ef579d06e9a93df8d07bd9b90ee919dcec23e906dee8d8e92ea2d9ab9a5649289cd9cfec7d86c2e3a86d8104f940375575339e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
594c38750227d9e178d3b1f4217596f5

SHA1
5aff26aafad0f49f86844572e38796d4cbdbe7f3

SHA256
d65c110c541a89fb036795d246e934c58955986fcf25c875864bead5e2bbf237

SHA512
f8d32db266098c66d40c133dc29e7e7d06eb3a75acd3dc449597d0e3ae33ff1806b84035ef987ff927e8433fe5d6bf984b0d9cfb60993077c37544939339fee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64f5b6ba62168dfa0b261773da075509

SHA1
9ceaeae62061044fe73b0d49de79b982c20c1316

SHA256
9fad8baa247becb1660bdb73df67478105f545b0dfc6e2d219a3086a07ef1b00

SHA512
09e80b89f85626d362066d9cdcd7fac1a79c706c586795b52a656dcada536069b79e75e189d147027f4665cfe7e4bbfd7949211ec7e65adcfcc46af4409ae6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98da2f8906d228e8d3eb94f463f01980

SHA1
e7fcda1cd1cc42fddf3bcbdc82259a50507409b7

SHA256
5227e837b6d6edb74fc5cacce2e62912a11ede4ad1123ca1d5fbf8ca306e903d

SHA512
efde5f7715fabe7cc2027353e4345133e4115305cb73af04576988a9cb7aa9db2b0818b154671d88e30d70fae099110cbfefe7451e9e9cee326bbb6d7196dc51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735d4ce7e514ebb277da81da2061110b

SHA1
21fe56ae2f2bf679e6804577d3d936b6a775e866

SHA256
6a937e85a5cf8e422901e2cd9b64f68b0b495a24a44410a6ca03439a0f450716

SHA512
1273ab7cd5666f9ecab8e8070a1f33939ee4483df88ca2c3ad431efabcc17587225a2f024b67aaf1e570c00af40ca19daf45b7ef209ec9a2474ea99a204aa4c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC786.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC835.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\WINDOWS\windows.exe

Filesize
232KB

MD5
cac402c006b1368d30ff8383dece46e9

SHA1
85ccfde9b2d5b8ecc3351297af19c72cb76b1033

SHA256
3c250b293707cc0bb51e25c1b33399346d79231fc223dade07fd289b6e0807b0

SHA512
04732ff4ed19e3b98ed1545a20d81a0da9cc2f01455ed614b78c42340561df545549bf5e90d8d3d60649cf41b883be8c9ce07d144410b8bc73b0a1baecfd43a6

Download Submit
C:\system.exe

Filesize
232KB

MD5
badf4e1ad839c9b942df7259c1900dd9

SHA1
78aedb4806396383fdb740db1c9a908abd7315e4

SHA256
7511ee2351753abc54a36c8ea27e0b93a503a84cedb112048c8bbe34921497d1

SHA512
c28054af11d2e29404c55dd1459e57ab5e6b165afd0d00de56d284d37e257f2ad806daf433518463ae559991e5215927c9ab48ac576357656e2c56bf7a7c5bd8

Download Submit
memory/2452-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2452-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download