Overview
overview
8Static
static
3IDM/!)卸载.bat
windows7-x64
8IDM/!)卸载.bat
windows10-2004-x64
8IDM/!)绿化.bat
windows7-x64
8IDM/!)绿化.bat
windows10-2004-x64
8IDM/423Down.url
windows7-x64
6IDM/423Down.url
windows10-2004-x64
3background.js
windows7-x64
3background.js
windows10-2004-x64
3captured.html
windows7-x64
3captured.html
windows10-2004-x64
3captured.js
windows7-x64
3captured.js
windows10-2004-x64
3content.js
windows7-x64
3content.js
windows10-2004-x64
3debug.js
windows7-x64
3debug.js
windows10-2004-x64
3document.js
windows7-x64
3document.js
windows10-2004-x64
3welcome.html
windows7-x64
3welcome.html
windows10-2004-x64
3welcome.js
windows7-x64
3welcome.js
windows10-2004-x64
3IDM/IDMFType64.dll
windows7-x64
1IDM/IDMFType64.dll
windows10-2004-x64
1background.js
windows7-x64
3background.js
windows10-2004-x64
3captured.html
windows7-x64
3captured.html
windows10-2004-x64
3captured.js
windows7-x64
3captured.js
windows10-2004-x64
3content.js
windows7-x64
3content.js
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
IDM/!)卸载.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
IDM/!)卸载.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
IDM/!)绿化.bat
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
IDM/!)绿化.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
IDM/423Down.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
IDM/423Down.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
background.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
background.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captured.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captured.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captured.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
captured.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
content.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
content.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
debug.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
debug.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
document.js
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
document.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
welcome.html
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
welcome.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
welcome.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
welcome.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
IDM/IDMFType64.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
IDM/IDMFType64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
background.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
background.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captured.html
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
captured.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captured.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
captured.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
content.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
content.js
Resource
win10v2004-20240802-en
General
-
Target
captured.html
-
Size
1KB
-
MD5
5062f9d1df3d8e0f7ab6aa60b9ed8559
-
SHA1
5a3f784811f44fc6c90f05c65f2293e2bb92bcdc
-
SHA256
2e085475431e6f7e08159fb76f80b37ec1c73c708fb26a60acb581b491cba5c3
-
SHA512
9b284a33645a8989403bd3676746413be76e0fe2acd84c28acc61beb5b058dc9f70c6bf6929a90281f876caf850032da2ca1b17fe4596c2506cfb0a667d47536
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9CF8281-7FF0-11EF-9FA9-EA7747D117E6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000009ac998a7e38c893c000c9b419e9f67b429ea969b549f6b0cfe02d51b2da689a2000000000e80000000020000200000003541597924be29e0d27d50f7f6e760e0897c2fac217bfabe3d73ab11ee7e1c66200000005c52a83df5b2c36b00b013fa165d80fbacb83a67e0f2187e9379e8d56e2fd55d400000003132aa956fa18cfd1a5fb44b64349a971fddd41aef204cf9b0134f6d170e9d902a6c9307f507e6cf30338d25accb3aa0790ef41a841e2464cfa471a700a61fb1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b15abefd13db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000009456ee0b1a21f61192938de7becdffab289feba6737d3f701011a97eb44f7041000000000e8000000002000020000000bda6f72b6e1f8c16d76393d05848e7e090b6dafa72075a724b29c27143a6c34e90000000312435edd996ff20f38e1bc7e0041ae6a895142eeee8bc76352b04c82f3f66a1577119c49b63f7744b725ef82ff27b184b442f6d409cdfb114a81e8c9d85bd7358072a70eb26f5514ddcbf5e11af62eb9f892a80be49a4a009a122f765792a2433de58b3ee9fea75728be54ce0df757a5309b41ee569c435a95aecae9ebea90249fe631dde0d1555c07737059bd62c6c40000000db19aeb7ee2bf6883449d5c72878af08a1eb6c9825cc4fb052fbb816f49f219cae6ec5dfaa48f457d2ed817b15dae515b8f18408beb286cdbbf9f0a5fe24e51f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2332 2324 iexplore.exe 31 PID 2324 wrote to memory of 2332 2324 iexplore.exe 31 PID 2324 wrote to memory of 2332 2324 iexplore.exe 31 PID 2324 wrote to memory of 2332 2324 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\captured.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f86a459f7b79758c0e996e035b7b44c
SHA1d38c1a040d6f484aff5d4d8abbbac2ea5e8c2e9e
SHA2568da1f72bcc35963badbb8a41f23aef5dde688a9178119f20d9b139fd0da35d2c
SHA51239f6ae6be18e36c84f477e17b29b94e19c161a3c76c0f754e68717512bfa5e3d35f364bff824d8334b36b167c94f4eaf7e8e337eeb9a438fec49b7c652bdc709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3b59cf31f221f6726d25fb25629f5ab
SHA15931551c304a34854d1259a8d663957946d2f5a4
SHA256d3a357c607589eae01e8b8b8d8894d418c3b950c3f8a7b3177456297a30e7f8f
SHA512e9a36db7306d3fa03aa5b6f109d73cc84edc30daa980c5a2b08c523a4a3c6a143ea4a205519714a4a3284bc68992d15b9540dd7068366e23ce9b44b2afc9a888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afd02e949b19fc736b592030c4eaf8e6
SHA100ff276b510c014219df306c1c5e900228d97518
SHA2560bdd490258eca3579f460d567c1b0014fc52f002fbbca59a6b22ca3f32247d26
SHA512936603ea22ddf3d1518c9b2b0ed287e12ed4842a3fc0bf1d4075dc3b0dcbac4e2d232f68bbb212d5cb06ca5664612367194086236cfcb8235f81a2351c3a4c3e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b