Analysis

  • max time kernel
    131s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 19:58

General

  • Target

    下载说明.html

  • Size

    5KB

  • MD5

    0c1971727b047450aead02d37117c445

  • SHA1

    bf50fb4c2e5d9c53659c3b6584d7c79477d452d1

  • SHA256

    09b45f792a0c100a6e1aef2fbeed1da96b53f3cb2b6ef4ef19c6809ff482bc5a

  • SHA512

    a392e4a434ad4d2aaf7453b05c270063f14729ff28704317101afa914871bd580dd9997f8653b65670056d693dc19cb0f1ab93ecea5569c66d7344394746ba70

  • SSDEEP

    96:mnOQeRA2RWhsFf6Hm4WtVgTrUdl//OdddddddddddddddddddddddddEddddddag:uX8A0JFyGlHZ4/z5w1U4j2NckC

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\下载说明.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    4080a7e30b8abfddde10ef0ed0283bdf

    SHA1

    3d1adf09af77d3446e11d652c3d638fd8c2164b9

    SHA256

    06479af286c97336859d9a3e7859c7748bc5ef056691ae9a40902f258e2da5fe

    SHA512

    64186d0b96faaacfec952d640302310e9ac71eaebbb24cc8f14f4d58d8ec8932a8b4bae7019850c4a1f4928b655769a9166197bba497f78e5f0f45a8d8627b75

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0e9b084e2a5d94407bd5f4f877d6d2d8

    SHA1

    1b7981e677afd04636dc489016381aceba61f789

    SHA256

    5eb1fb2e59751daf21cac454825188365b4300ef4b9d0065347a675133dd705c

    SHA512

    952afdd6cf20eafe46171c6a6e4e95f4347626629e28f82119e149e4b1c451e3d4941f853734fdf986116e368743cd1af38e150341b5c60212df64252e280975

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ecc96852b0a71a085fec3f3a2f91968b

    SHA1

    b457856c0e15a99e6e9da4eab59545c325a3195a

    SHA256

    efd21f492207167f16a55d2ac77f3a9f10e8649976e4b303c3eee6955808dcda

    SHA512

    6761c2e69d3ba9de851ee55ca3eae1c943b956ca520f3cf8f614ef286ebc64427cad8b14fe58ec3df8913a82e47dabd98b94fed36067f8b2ea58d0343c7dc52f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b074c8c7dabe545c5b604437e44cba55

    SHA1

    1b1cf42de41603a3c7159fecd527a3820758fbcb

    SHA256

    6d3f4e092b396ece98ae4b4745c19faf3244365d8b5fb52ef56d37bcb032632e

    SHA512

    12da5460f331c8b34db604969497ab26b3877595e4b927bfe00ab8899c732153bb23d300c4dc438455d98e987182360ce76099d3b051e0164e28a44d37ba32ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9323d00dabc45a204d55e6552dc8afd8

    SHA1

    d2ecc0aad4d0a35260d412ce039ea4f79ce91acc

    SHA256

    c84749ebe0fb7db563b5126e3968f1b5a37608461bc546412873b7af441a7eb8

    SHA512

    679330a36b9db33540016f5b1ac913aa82bce3ab8a210bbbe8896fdb53fefd3ef093b9cd105fa03366b3f037a68573e7d9624a2888df37203e9520d47b9064e8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6c8aaf63fedd9c2124e628c2d07c1184

    SHA1

    b96cbfafda4594d95541f9d4690c343dbabf5c43

    SHA256

    1557743816a322001da42089f5cc9de3af922b14687c4d0fa3f1224b343fe1f3

    SHA512

    10089475c9bffaffcdead5be42166b87c04ceb7d09e5cfb62fc26e43eba1b67ca358eabdff5dbda72757bce975c4089461d6a0e1c91e090e769cb39b64ba6466

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    64c2b2991a4f5d23bd61a71ec727028e

    SHA1

    c7468517ef5044abebf8b8d0829871eb890b1484

    SHA256

    c42029488da4604abcc2c2fb4a6c571826f16cdd29dc874897c2a8b1cf992b98

    SHA512

    a1e1bc6af1d48b0a39769d12d1f1fd3143454acb5b91aa99c8ee0e7c7886919ce10a5eabb756bd1bc40621bef0823a3e4bb518082416234158c34aab51e1dc32

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8a563ae10e46c6abe0152b0bdbb790ed

    SHA1

    50fee1407bbd94a58ef7873e4cc2e0e0ea932ab5

    SHA256

    294475d96781b8fcfab71e19073946a9f0260135fff265f149996a5a1e2864d7

    SHA512

    0297f71219bba108b407aa56b700d1001146d7a419cc6b979da3e6c085b123f45f07a82fd09f1b83f7c88939dd6503519aff5ba578911bdacf1970cfb55abcf8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    36841dce54609a8ae95e4d42421765c5

    SHA1

    1716cd487fe3edcbfbe3fc23efe217469ce6e41e

    SHA256

    3440aa376002ee2b8d365ac963334a9f847501ff18af3719281243dbb816029d

    SHA512

    6d52d14eb082d8f23a2f5ed7604ab05b4ecdd5689257fd1f68a7ec25e2ab81200cd4114bf2fb31c28718a473ee78e945b00bbd23d8c3a97c45aa969379e6f0a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    31cc071a8125a6ee32f3e3db02fd561e

    SHA1

    6b5a321172566e5195b579893dbf011519f0e160

    SHA256

    3b73154667d7be31cc7506fb89caad1b36bf9cf13aa671b07696d44217245eba

    SHA512

    8d6322d35c8d9599caf7868bcab372733869b5b1daeb11b88a8e002a34fd32c3d293646b05051cf34397178f41f2463545713fd84fb54376b17d1c2eae4e42f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    42ffc6073ec53c8e0cdc4a81486011bc

    SHA1

    addd418578b31572935cf81ea3f2ca321e2cef1a

    SHA256

    72d95cd707397d16db9e58f89d5f8499d15b19f28d616036fadf00c51dcaba92

    SHA512

    690554254ca9f977d48db99571a34fe28160961024e596f14528449edb9abd8e4a54cf2038cee457fc512e3ed185bb43b13099489fb1419f1d28f87a242c6275

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    979032240923a47621fb0c327b1f7f2f

    SHA1

    b6cb523c272290355180212edef0bc0430048981

    SHA256

    1b322abb728ab3f650cfb113ad516d01d605003ad8318f662144652fe2af03b1

    SHA512

    fe203ad16ba2ba284bfc670cc3357821b4ca419c51587dcf0c03e3d6f2b71f18dc1078dce8686db9bd52b966ef4d8e0c0a116427a451f7ab841c6d95191e2def

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ae5e919fd684a86091602a926ff467cb

    SHA1

    87cf1007db9a8663384a50eeecd746eaae338b3d

    SHA256

    d51631be3d94517be6e39cb154e96caea9d5396dbe6ff8f69aa0da2c0ee29290

    SHA512

    a58cae1b92bb70d6a9861d4f029f26d874921233ad324d1b2036145cfcdfca507d5586cc1715092d43e76646846f6328136d0a9def9fe1a143510cc589a87571

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    72a8b44cf351cacf7a7fdd7f7633fa6b

    SHA1

    cfc5d2ac4cf1874de821af3b694c4bcb9f7a1233

    SHA256

    945894289909f4d78b147055a90337bd2f37242328842a29723f7acedeab870c

    SHA512

    c1e84e0be9edf88a368feb7de72eba6a8c075b5d015d33da60671b133997bd2d2f940600436fa0cd0dfc64eb85b8c4c402974f760ac4ba3a1f4fcbceb464140e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d92c70eb002b16741809e25ebabdcd29

    SHA1

    f7ad3b1fac3629aa4311223b8a6f520a51327fc7

    SHA256

    ac98a2f0eec5db4abd38304274bbbd9bbcc0d20cc06dd144ffe3200368b19955

    SHA512

    700ecb43767c019b06a3953b8800b74dec051dee98502d2e84db081dc88b3e88cf996848073303a0eb367ba8dc21d92aadb2e176edd2628f93f4a3cc10d1594a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3e1175e39598d648e47ddfedf73d86c0

    SHA1

    a666d2d3d59f85a680c6b055bb1c8a99c6effcab

    SHA256

    1ac0b652cec8bb9f4e515c0870dc8ed57527a9df087b55bd83c7a00e91c1d404

    SHA512

    1e2004cf9d827dcaafca04f274d42c634d00bedcc230611cd6b7e4e7be43154bf378fcc1d7921871a9b792a73eb2cf0b204906c413aef9335616c57323c4d0c5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    27f83e8e39fff6769aface207af2d184

    SHA1

    f084e893eaff323694f4266c60ff3d032b25d9bb

    SHA256

    c1a117ba69d81b40acdbb7ea8ac4fed6ba8165cfff32069560d638a93bf8fa39

    SHA512

    180bb716a316bcfb1bb54383aa2fdec73b52adf4666ed259cf7e47ea97c195c336d849fdef6b92b5780793bbe7ad4876415db4bc7d13d29d758094f56f56cc0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8c577f1aa931abfb6d809549fce6c598

    SHA1

    207528105222e4ff492d779d521f8b0e0c352633

    SHA256

    9ccf39841865acd05fc161e3bedd45636b9ac01dc7b59775b325810eed61cf75

    SHA512

    4f40a32d9b731713264f4a2d96cc835574383b5856d5860725ba8ab14617c51f240094505f2856d4590e2d74d806874a88732f84294826a0e11104fd8f23f6d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b093f9c387fd5bd1401143012aa745c2

    SHA1

    c8930bd49debff24b2f5e464c09a98d7c812addf

    SHA256

    b0db6d3d2b6964b7e18ff8b317bb31ca87ba3df61e7275f1dfb80c07c0a4a4d2

    SHA512

    fc9d6c2aaafbcee0217eb481d16c7538800d7c97e8b2933627dcb28f17e634c0bee30d48bce1d91ce3ecc852ece50d72ae53aa400f14dfd56e3be095e766a2ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba59a178af0d1642ccb2decfdd3fd9b9

    SHA1

    9d9f53f849896f32c2ea5753fd58e07ee97675b8

    SHA256

    71fba793a482360843603b352cddd586eb5935d01591dccf97b5d88e1dea91b1

    SHA512

    8f3edb6353c6ff0e49a9bb67e209134d94d61847e2ce02ce23dbedb7db3291115413c51c76f0be45f24beb6d301cb0b2ba3562bf9305b71ce4941dc95e60b658

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    22cdb5d9f8915a63572593765c9fd443

    SHA1

    c7621612fdb4c2c9bd234d4461571743cbbed78e

    SHA256

    f19072ed017ac92334ccffd9b7f38c4290f3bfc0b3ee5eefe4473c9f642b9ece

    SHA512

    04c40d323e76c1bad66527fe207f2be6044d6c7327c7a1efd1ef9c7d0fde7c76ca66c3d691291ccf78373ad2863dd947260380c7505b6a0b67f49df4d68559bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    a965c1c1e8242df10aaecc425ca4b2b7

    SHA1

    a553d3e73f8fc28b42813ac015b8647723b585d5

    SHA256

    e2dea42a5b2f1fdd0fcbe1a897eaf23d5355de777b4148f08db0aff5ac5d8752

    SHA512

    0c37cc5fb6784899b03c7ca5384dcb1c420e830f0a032c3c8aa764f2de3065a41e812908b4c1502d21d6ce2afb50b1d0da44b5e9f15dcc3ecce698c7346f58d9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\689628-2024090916480466deb6444fdb9[1].png

    Filesize

    91KB

    MD5

    d41c33adf30b6a8ffc590075e958fc57

    SHA1

    d571b8d712bb337836f1f54c68c4b635a07a9ffc

    SHA256

    71c20231f45f381db112b8b395bd18d11a730457ba0cd2521cc28ecd8259dfcd

    SHA512

    2df012ac2dceb8132e5aa0889ce1b67dec06893216a4298721c5f327aff8639670a8adc510537d9044b2f294c9d27ea74b8ffa42af79469da73d48e9832d937c

  • C:\Users\Admin\AppData\Local\Temp\CabDBEF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarDCB1.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b