6663ff536e707a57681d585f35903f6164baa543667411e89050add532240bb1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

表情/龟龟.gif
Size

2KB
MD5

20cd6d58ead7ecc754c76a5d3adb8e56
SHA1

2b2b4da3864b2eb058d2e6adc3d50d1115f57af4
SHA256

d7f961e4b08d14ee83df1660a49b79ca9b87929d91d70d0b8507f75cccc1a828
SHA512

f05d4bc238eda100121d881f70dec5d67a72e0a463fed8dc11b0436b5d841eca9e124b3c1333296ebf16e0b7360ba71112a4636d36b41efed1c1ba072aa7a64a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{086D18D1-6AF5-11EF-BCE0-DECC44E0FF92} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431640479"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000046ec74d91694634aa956ef95d324cb993302463ad1eb4590ed7bdfa8249511cd000000000e80000000020000200000005ae012b98f665782ca3a493eea5d5b5e5a1f10a48e2784d208a6d4f13d90e8dc9000000030a99c192787ad6afb9402e4f86fe46c2eaf6bc9bfe043be30a84afb3db15a603df8ed5ff51eef97c98a23f43e0b5be6b77e101681a0d154e8e7468258f98f86a5dbd4270d9db1005eec635ddb16eb8cabd8441e2496543d144f505f7ed5c27e433f0da7680a3c480d971818700598c5881b135869bf0b3791f9b134e2e348ee62315bd8f0c7f16734d17ff4d9b2bfee400000007e48c4368d0b094c00924b77853da5da2b7729c4bd270c802930f313edaa4e824b78d81eab52d2a8d3a0293ecfe3dad8e9b9da8401491894ebf5a0f1ffe5e466	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000efff95b5508a97370204f1893b569b305775c6ceb3375d2aca1cef3bfc48d457000000000e8000000002000020000000e4937c0e8a9b61c20c23e09435e79173658c86e008ae7282c40f7ee9f5f9a7c82000000060b3d745383b7a8b0d8fae7e45254bd453cfeb455049f87aa3340c9ac0721d0a400000007f32295a9118607583d9a3a494c39f6b888ea4704b127f49fa1acd0afddbba2e32ad1556573a620e056c82d78bcb8ff360691fb3ddb7feea28e64d3c067e76a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7077f4dc01ffda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2064	2152	iexplore.exe	30
PID 2152 wrote to memory of 2064	2152	iexplore.exe	30
PID 2152 wrote to memory of 2064	2152	iexplore.exe	30
PID 2152 wrote to memory of 2064	2152	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\表情\龟龟.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a33fa93b5bf9caf1fa1963cc01978155

SHA1
e170400f6508f50ba71e4dfc1328e509806c4e9c

SHA256
133048dcf745bed2146325c3f0c3412e51f3515508104b21f958a38fe79aec5c

SHA512
9729a0abd331cba5a74c0f378334e7bf3d5ccaf8f4a3ae8ce0d6d32ec83c644504644ae64ae013d7a3ac1586be313480be3ca0dcc341e1d5adc432f88460170b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57dbdd223448e6cb17a8c0719f7c172c

SHA1
6d547bc75a7cc6bc0d7c7c32a2e858225215d777

SHA256
76b74d9cbe358d96f3d4f2aa75ff0abdbbd705d99e0364a7248f4a82137493aa

SHA512
713a8f5b356cd103d8692a7c6b25fcc442ea5f0cc77fb9f6c6684994533c70383cb09431b3a1aea5fa1978fc1a04451068b3b6489e3927d7c1fe8533f1488ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0acb9f3a54fdf3e5c5d461499687e630

SHA1
2dfa7364ec2277b3ddafdad12400794b5c90869f

SHA256
c4729c1bd6ae8067566efdf693ac71bc475424640722c21f128b74004cfbd198

SHA512
0e5188070c707ebebf8ca497facbd691f8681ed6544e96a40ba839b5b286cdd69f6d0fd7af1078c5d25d4ffe46f8297ef380841f1b0ff6e8798aca170c0f273f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f24163589e48c97c8bd409e0eec86aa0

SHA1
2fffbcf231270ead2996f564d9bf66474331c039

SHA256
89bcfb05a51147b9c984e135c338cb8875f40c736ab9c10baabbf96d5893d186

SHA512
ea438bd1f797a916886d555a583015f8a6a9b6d7ffe6f7ac4403f724b3f02278537f9b48c51418cb5a7512ba4b1e856c2f3cd2cb3f1fd2d6353769efd2d56073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08fd4ea215d7027c910f0793b6ec8ac5

SHA1
fb295e3b0d77338506e922b18aa4440666ef9e71

SHA256
46cfb28db99f7c7d0f6999b570adc7b3f5ab9df126e14b9da16f5dd86cc24e19

SHA512
741abcd19b8251fa6bebc1b328b83dd5d0523ed9fb3add5b47ebefb16a7d9e67bec9b67b941b9514891a88d722e8874ccbfa9d5a2cae77fc57e2bc87c24361b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c34fc1703491590eb609e6887947cbe7

SHA1
26f86a2a03c5cc50b98fdc254306cf3bf6f49c31

SHA256
ace7c764a1c44197943d032907ce23287d21dc0767684d917d20ea74848c3b8a

SHA512
18a92eac6357cf7077616f0ef0a3e3b5de5bda0d6fcc1f02973b999a687dc00a9ddb802551d2c14dc1ea09b977fbf44d23448e2232a073196f986f3809312cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ad4d81aa8454896604ca46cd526c69d

SHA1
1c1ff4d9d08bc9e41b0d3de062f1daa3f053b2c4

SHA256
9372a1b6223aee2ca123f9add987e6b0d58d93fff8c753d3bb3e70e22fcce95e

SHA512
0a7544ea3baeff28525479d9ebd33d324525180fbb3a2919959a811c16698c08e5c9f19da9f6d520bf653dd904a7c10499068f7046e8558669c73b466e29e6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2b5683b1e82a11033072f8ce2d890fe

SHA1
1db91c7315f5785a7656c07e4bde2a7973073e30

SHA256
2b9454ad8d748c9eb2ab083c53c8217e371f8828f12f8e740ddb3ddb2b499c67

SHA512
115227ef7d441d56b1696602ffcd95cb13ec2987324862992fcc758838c45184a4f07a4b51ec8e7d94820fe7d9de8c72212f14d09a4d0b10443ed16818b80cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da47a3264238a0df718593582d60b14a

SHA1
96df213d79a3a1642501fcefa72c1bc6cf4a36f4

SHA256
24e85e45ed95b4a080aa93a582a337d37c64d2c7f2caf92e5a1d08dd11b0618a

SHA512
817a0e2c3491a3d295e2cde8c0ee4478d243754634535c9b05b98f3dd0ee508ec182b54a9683e08bed716c4a4278fdcd9e2de7bbda50dbd49272565b3523a3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07578a2e542d380302e26aa23c1c6630

SHA1
93fe86b6440157f0dd96e3917d950cb71b04da45

SHA256
6b5206f4e067b69f2f8e140a508d77ccde3e13d4ba66f64a26837f062210dad1

SHA512
702b5e14098383f94fd8898dc263ae7368552ff48fa5c0152c86c5a800eb50263ae88c7bec5f48d2605126ea95000cc3b8187dc7c722cfdd4c34240a25592d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb52059914ada7c4709d591d625b091

SHA1
45fb9d01355dc9939e02be2235cda07b5d97dddb

SHA256
e61c989570b9beba5e544c68cd0a7b7a980a3e0acf3bef59527c17462994c7df

SHA512
14df5e2c5d0a7dabede66721f9bd1fe19c84b106972826b82a013cf9a03f5432d6e6588c25f1ac18451535675c7114bc0990f7ad3d65798c922ea17a8c8e3b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0d23218309f2192e382ad4573c2b910

SHA1
d969cc3a091e4a15968a81e9cd227746063465e6

SHA256
66124a683626a87413e974b938d973c4123fac994d83ce8835f50d3c08d66db4

SHA512
3aec19a1c91a972ca9c024227ee7d0b7ece021393e61ed5f762a7d2853d7327cac7c37c85a7967ca6981a43c08eca5cd18633c6fe3927734d7f8f632024cb639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726c67876bacb33d2ed7bd48936da554

SHA1
df0ef536ebb019d400fd57bd7993a998b8f43800

SHA256
cfccb0a23ca04f7a8e3c0cc44bc951f11629fa75627e42837ca2ddb444d23689

SHA512
a87cd8aff4b1c4d93c3528c8e42640206c4f6d1299784ec292308473a990ec9b801e9d3acd4eb6526b2974f6d835382f207cda7f9662f0d283a9c639ef019438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
178e36e821e7762171d0f84a2a904a9d

SHA1
afba541c94f9092d890d1391de9dff4c8edd4c1b

SHA256
2fa379979424df667c4d064e57d049f66f26589b23169ff7c62f02e049849ed8

SHA512
0f36ecd2cc1a2833161be23f830f928a2bdedf18fb110cef61e1feb6827e80b090a9e9a8bb8e877f578a97af2e646837dc9d03063a06e9e19a4312c60a021030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7907317bdaac4a88fe5e33adf41135be

SHA1
4ebdc721b412d5cf252a0b2828c93a74b9ff768b

SHA256
2a41b77af65c88abeb32b81504735d42621ba85d45f5a341f6d8ebe9218dd6c5

SHA512
d995321ebebd70f71974c9c71b20eb55495f47838a18c377263ed50cb3e8e9696777ac20db7a69c45ae29888b3ddc2a350e8987c02b838f751461c8179f18e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDC5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit