Analysis

  • max time kernel
    117s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 10:19

General

  • Target

    先登仓库管理系统3.0/安装说明.html

  • Size

    6KB

  • MD5

    89cd338a2592a9abec8d0ad905b07bfe

  • SHA1

    09f8c58b4d0b9df6b721a77bfef6c8ed3abe3653

  • SHA256

    bf21cb3253227ee4e79b43de894f7212ee2ce393fd5ed8c15e90e34b2f90beff

  • SHA512

    313abbad9dfba111040ca5f3f65193d22add318a3c51a5b676dba25d97f29526e04416bf724ab0b8e64fb2e1971fc1df450c2eb720090772b1f4dc7750a8c528

  • SSDEEP

    192:c9waNKaCAjLRH4HF8TEB69U2jhawUCS/8aUpCaCxg8tHU9xXocOdoyGoXtoza+:caaNKQKHFcy6KahaN7EIEC0MIOq

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\先登仓库管理系统3.0\安装说明.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2d48730f6807bfa4077d99ab3447ce9

    SHA1

    11a1e41598313466a2bb4090017b58ad0d44310e

    SHA256

    ef6af2f5522231970f703c5881fd57f3f77296d86cd134dcf1d187c597f30219

    SHA512

    2cdc27b8102c9f36bbf1a2e9a4d10d7fdbee343a6e67362458adb6c3c75ff7e229f1e6c960c090316a83e534cbe6fa6548e4ad59944e79ebf1b3b7f7bb820595

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2dbcbbaca6d0e9c95ae9a3756ada579f

    SHA1

    96d97379e32d547a55ab4d31f4868585f678f908

    SHA256

    ebd1dce2dff0710de0eb938017bf8371de5e538c12fb4dfddc61bcd3246da823

    SHA512

    ff85eb33ad34e0e57e58e29e3bc273c0976a8ba12af6018aa339ebad873e45c178d5d95bc882d5c9d09c45ab6a5df323c3c10ddda2025f0c46c472e2fa1172d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5fce17b5dfe55bb1f6e1d27c39cd8ea0

    SHA1

    b8d949b260201bdcfc81a4611691c85a2dc3204e

    SHA256

    6506008eceb1b10ac542b3fa98e27d8d4e286fb143f3948e45816d39262b5dcf

    SHA512

    1ea3d4c548e10a82be26a0a1f7f10eb84601e1d9a4d842c7dc69d002fae067b4f353bec9ad29168c3437aa03838c08f49ccb3cf8cf10bfa198307c9e4075ba2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a4ce3c0b94658fb282f533072cafce2

    SHA1

    92e87f48e5fe0529a2aa44a6607135cc0035a67d

    SHA256

    3d16b8f4a4b63cf0cb19b1e9540e22861b3dfd21dd8f7191cda93d79a3074aa8

    SHA512

    254746ee37861d0867cbc82ae73afb58fd69b0f3eea37ffe33833bb7fe95c1aded812920112e1df8e916427e556bdae834b22bd6132f5934f7911640bb1490ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47d522f02f09bca86f91852c23850867

    SHA1

    87a6e223cf24d69b1a5452b4252d59ea618b2fdb

    SHA256

    ed4bd8c9c317d9efee69ac0da92a24d5126cf335997cce656856322a0c1a65cd

    SHA512

    aba94506555a9d6d899d5af047777bacc22984029c7457c5dc432da574220c503ce597f868149328cb2980a6d2b6927a8b3273e0c09f184865ab449453f29829

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d711d7bd70470aaa3eb004d7e70e69b8

    SHA1

    e5c7103e737906cc9d76769ce49c4d28c2f7e15e

    SHA256

    8a916baccecdf89aba7740cef0376dbebf756c8cdd7607416bf604cfcb4b255c

    SHA512

    c74d9669efa2b3b20b61194d2a8439ffda653772c3ccc7de798ef3a3a37349aaf283aa0ed33df92c49d3d96e07b0679f718c613953bdc8428d53f88c597b47e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d913c5e35d69e57e74c1abf57f5eacfb

    SHA1

    3a12336a7e8dc67a701121fb280744fe797bca95

    SHA256

    b63a82fb80289e558c2f5e86e928ab3cca66a75b148d172f559bd333911b54bd

    SHA512

    7a4b2d63bc5efbd06519895b3285dbc21da8bb696b4722de40ed04999ccacbebb272a3708919050b5735faaf67e46f4c09d92a43372cce0b316cb0b4027ed148

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    addaf77ed90c662966f92c9b086a1dcf

    SHA1

    bd4dc15a81938969f0487905a61518293e0e6bd9

    SHA256

    23f7f806cf77f5f482bb4607a72c0dbfa7f4e41fbe3c3555e9ff99dd1f288b6e

    SHA512

    f9a4b19a0de8394421642887ed2121527018b1209f5c7d045c05415a0e8ef9d7cde0608d555973927ba90d1e72f897d2e47ae4f3535f943488f311717c9072a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    894f63ef3e0fc695800cee50dc9368c0

    SHA1

    c108cf89c1b26504edd0fc6ec371480e9a5d5ea4

    SHA256

    787ffe79473e44257b94b94674a019991af67a71c074285acaef696db8273ff7

    SHA512

    065490e5525a98eb471e35c485830b0fb5e88768669f78521f75685caca841c98fcd8963cdd3ecc252656a37e62ce41e803b1cd6f442939aa9cbc43a5cf4c07c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b61b1d15e3a74948195a175676ca33c

    SHA1

    53a4f727a0ba558fe44d72af68ace5230642f2ab

    SHA256

    c9395e55a5b483a696d66076eff7083a872f36a569adafd4e11d1cd4c2b3f27f

    SHA512

    664dcb42988cad2b579dc52cce0ef1f6a0ac6c9a11f1fb7d18da391ecafff7f1349adf0d8031f73269fbc8a22d3d809c6aac4323fa10789144353897dc39be26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a89c718230d3aa3990ae776d20ee68e4

    SHA1

    d312ab8e1a1548a9bec098f3ae365aa105f6a1f0

    SHA256

    f402babab0e1082efcfd67073f201080273fd6d070e1aef8600744bf70916ce4

    SHA512

    c21b8ef39644b3029aaec59588a837bd42f65a85ac0fe0457edb14c405772518cfdde7e4c2afd502e6008c3589bfeaba772332d2ead8c109ab2bfdfd7d363cfe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e4af14044789c57b5881bce45ac253c

    SHA1

    94d12a55cbecb8db2cf9d08b04dc6a60fe89ab71

    SHA256

    8d543535d699de83890bcbad99292438330ac71f629374783bbc9fddf9b009f5

    SHA512

    ed62ef8da245372be533fd585b7d18a8531af7cca9bbcd1e34b126a35ecb07c8e6659ade43061b05454157468b1a8ad2b8bfc53b1ce36bce5f1631a2fd2ce25b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    94ddce3872173ac914bde32a984fd67d

    SHA1

    0d768662aa158e69bb0c0bc822f8add48c9deadf

    SHA256

    2e73ef000b921f89a8bf4798b7b327fc1fd2b8c08a1fad2f22a471e3055ecdf7

    SHA512

    8bda28fc7737eac65fe69b3707d48873bef747aa711e4f4a11ba0f25511e94486bf60faaf018de0f759c60a516f0acc37d17d42ce413331db8c956679b25264e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    453849382d1c43d748a454c55bbfb41c

    SHA1

    48ffd98ec484ffa27335fe9fc0e285286f5096dd

    SHA256

    b39d45113cf1d41b8d8a14b0dc9f29a56127cec786963028e71c67470ffbc847

    SHA512

    c00048dd7201a102cf7312fe7d921dd2602624c39cc96b7039bf3fe949388f572d6eb967886d057651bd89080e82d41c95da6eab42dd11b87ec5548d87fbef24

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8444e21585a5540bd546783ff1b4c52d

    SHA1

    25fcab0da742329a323596c9b347fd28b0fe0e95

    SHA256

    7c3e82ceb4760140f00e38c92bb6fecc10b302f8ed2926bdbea325648a551bd8

    SHA512

    5e211810a232b6e8207c3be39dcde5c2ac53f82669ddb4749584417929cdca16fbed4a6b9db67b6358894c40a6771e5f4356c85eaf56e5da92acc69e866dbec2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    abe08adb09e4111d0e9f129453ad2e5c

    SHA1

    d79d9a8a4e42df89fae213006111d1ef608a911c

    SHA256

    d2d34c4d9470a574fa237a2c6b8303f07632d277640e183a330704e69794bdb6

    SHA512

    cd8dfce199bd0e27ec8d6e318d986cf01f289407c5dba7a489bffce5f94d53ef28aa0e9f951540ffd051295994dc8605c68e47cf99aef692c0567435068c4f44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b3580037c3bf515ebdc880a6a3dd0e02

    SHA1

    fec9ba99a7a0aaed0756b366ccbf221ebaefee90

    SHA256

    0a034e48714f68d2b419830b8531ca3f82ecfe7966a675031c151012f31893db

    SHA512

    849d505c0bd94036074ada7a00cd6294f1ab14d8ba9fce0400d5d928af981284bc7378360b3261b5aec0a7fbb2bfed804515b14208fd2d2726a0d6b57f4a8129

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    881ee8f44b23e2349056a6a7c13f9d35

    SHA1

    1b0506d19765fe9bdb13414fba8f2aeba47f3a1c

    SHA256

    7c2ec9a61f62bb0783ff0bfc0a520594ad36356ce0de67b19b79f6babaac3737

    SHA512

    25acb93048c226ba2168f3518a40c60397354a4488948fb337984f1cb58aae3b7470a716fda98e92025909cd3b7e383274c7e513f63e7bcaf666332a13c6b7ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d272b6655c7fdee931d6ff7b1de8a366

    SHA1

    2a5f904c78922f128bdee290d653446db239df66

    SHA256

    e4fc4168060ec3008bc52eefe50c181c68f46deedbb7b43e4ef9b3dd6c0d0adc

    SHA512

    db6eb070f8288fd9ed99e056f4048cfdd38b793c6795a02a7696cee142403f7a5e2d0812887578f8ac7d491509a66baa59df56c1eba62724c85989672a111ac4

  • C:\Users\Admin\AppData\Local\Temp\CabCC95.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarCD34.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b