Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 04:26
Behavioral task
behavioral1
Sample
bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe
Resource
win10v2004-20241007-en
General
-
Target
bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe
-
Size
55KB
-
MD5
2d54ff543c33342641b636d0ad93b32b
-
SHA1
8c469b687a6ea57c560873c8afefac0c6fcdd54d
-
SHA256
bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b
-
SHA512
36621147818e4f70fcf1131ed05e3f5cce8d0daa2d05844c83d1776a57da1f554d739a6ec39bd9e602a31c36cb70d64be88cdb3da77766beb1ef9e05bbc017eb
-
SSDEEP
1536:RhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb:BZl2zoxV1i/NU82OMYcYYamv5b
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\ie.bat bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe File created C:\WINDOWS\SysWOW64\qx.bat bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs
pid Process 1460 cmd.exe 1172 cmd.exe 2596 cmd.exe 1548 cmd.exe 1176 cmd.exe 1380 cmd.exe 2172 cmd.exe -
resource yara_rule behavioral2/memory/1744-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0033000000023b73-10.dat upx behavioral2/files/0x000a000000023b7e-11.dat upx behavioral2/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\windows.exe bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe File opened for modification C:\WINDOWS\windows.exe bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f6e3234d2bdb01 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e3900000000020000000000106600000001000020000000eb61b8129730f5c86da2f34e539d6c9346317cbfc842a94883ca6b78553f3360000000000e8000000002000020000000204f69666c2cc85d6befcb8b2e9f6b1e02ad9b1f0b42595fd451e99c11401aa8200000005b3d22c53641ace294d37a5520867e808813e4b39d40f94d8d8239acdee5f041400000000d81db14da271c8dc1c2dbd67a245e01bdcd758ffe67d6b6278393508368ebfe4d30dd6e2547c94b5358352cded696e3cef92b0fe9ce73830d68d91ebb26d33c IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e3900000000020000000000106600000001000020000000883b393558d3a4068639e1fb3bb3d51c72b91523d64d8dc5ddea385fcb64de9f000000000e8000000002000020000000d978711c483b4dde784fbacf24ee5c75baf0e31bf5c07ad7175b5381b8b42c5c2000000062349e26355f3e90851f6bf4d0aabecb96c1090b6df528690b2fa0240fc15cd24000000066823bf39f2a353f9dc59a52d84e2fb11726196136f790cb9072a463760463be207824ee0d860b61b324b2ecd7763af2692fe203f61da6713d1d03049091d50f IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1022eb234d2bdb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "579804950" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437113766" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "579804950" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31140685" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31140685" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4E1743DC-9740-11EF-ADF2-FA9F886F8D04} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "582773418" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31140685" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4352 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 4352 IEXPLORE.EXE 4352 IEXPLORE.EXE 3076 IEXPLORE.EXE 3076 IEXPLORE.EXE 3076 IEXPLORE.EXE 3076 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1744 wrote to memory of 4352 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 83 PID 1744 wrote to memory of 4352 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 83 PID 4352 wrote to memory of 3076 4352 IEXPLORE.EXE 84 PID 4352 wrote to memory of 3076 4352 IEXPLORE.EXE 84 PID 4352 wrote to memory of 3076 4352 IEXPLORE.EXE 84 PID 1744 wrote to memory of 828 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 85 PID 1744 wrote to memory of 828 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 85 PID 1744 wrote to memory of 2596 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 86 PID 1744 wrote to memory of 2596 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 86 PID 1744 wrote to memory of 2596 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 86 PID 2596 wrote to memory of 4420 2596 cmd.exe 88 PID 2596 wrote to memory of 4420 2596 cmd.exe 88 PID 2596 wrote to memory of 4420 2596 cmd.exe 88 PID 1744 wrote to memory of 1548 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 89 PID 1744 wrote to memory of 1548 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 89 PID 1744 wrote to memory of 1548 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 89 PID 1548 wrote to memory of 944 1548 cmd.exe 91 PID 1548 wrote to memory of 944 1548 cmd.exe 91 PID 1548 wrote to memory of 944 1548 cmd.exe 91 PID 1744 wrote to memory of 1176 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 92 PID 1744 wrote to memory of 1176 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 92 PID 1744 wrote to memory of 1176 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 92 PID 1176 wrote to memory of 3732 1176 cmd.exe 94 PID 1176 wrote to memory of 3732 1176 cmd.exe 94 PID 1176 wrote to memory of 3732 1176 cmd.exe 94 PID 1744 wrote to memory of 1380 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 95 PID 1744 wrote to memory of 1380 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 95 PID 1744 wrote to memory of 1380 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 95 PID 1380 wrote to memory of 3932 1380 cmd.exe 97 PID 1380 wrote to memory of 3932 1380 cmd.exe 97 PID 1380 wrote to memory of 3932 1380 cmd.exe 97 PID 1744 wrote to memory of 2172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 98 PID 1744 wrote to memory of 2172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 98 PID 1744 wrote to memory of 2172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 98 PID 2172 wrote to memory of 2292 2172 cmd.exe 100 PID 2172 wrote to memory of 2292 2172 cmd.exe 100 PID 2172 wrote to memory of 2292 2172 cmd.exe 100 PID 1744 wrote to memory of 1460 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 101 PID 1744 wrote to memory of 1460 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 101 PID 1744 wrote to memory of 1460 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 101 PID 1460 wrote to memory of 5036 1460 cmd.exe 104 PID 1460 wrote to memory of 5036 1460 cmd.exe 104 PID 1460 wrote to memory of 5036 1460 cmd.exe 104 PID 1744 wrote to memory of 1172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 105 PID 1744 wrote to memory of 1172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 105 PID 1744 wrote to memory of 1172 1744 bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe 105 PID 1172 wrote to memory of 5000 1172 cmd.exe 107 PID 1172 wrote to memory of 5000 1172 cmd.exe 107 PID 1172 wrote to memory of 5000 1172 cmd.exe 107 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 5036 attrib.exe 5000 attrib.exe 4420 attrib.exe 944 attrib.exe 3732 attrib.exe 3932 attrib.exe 2292 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe"C:\Users\Admin\AppData\Local\Temp\bda35ce31a90542dac234b4a57a057e87af13fac84c41808b351552e676c351b.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4352 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3076
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
PID:828
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:944
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3732
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3932
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2292
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5036
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Hide Artifacts: Hidden Files and Directories
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5000
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ee4ada789158c1e5a14d597cf1d5edd0
SHA19593aee78d30d51ab93d6a29dc4dc873e0d466b6
SHA256903a6d82bf2fe8951104cf90d9f64aab0fbded30a2246e678a80d07868569b4f
SHA512a6214f62e5089512aeaabab7c4bb38e8663fb55d5f4129c57e726723dad10802ec40c3dc836087713b77c1874c12f177bf2b2998fd3e52f4210c1c5307885c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD54c4a67a6af6ffef3895c962045ef9a7b
SHA1517e72f0e272b0d2b799725836c141e749a233b1
SHA25674fe1ff2b3ddc150a4321f434d03872f6c118f18359b0706fb4cb79f4560925e
SHA51259226dcf31849b949921fcfb4eef9022d42202cd4afbf8f6627de8de8ae9e0ec0dc0affc61dc9224ae1c21c6f6188a2aa585fc60b953b6513a211a258db8a79d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
55KB
MD50d643f8ca9a5f24bac69ccd1986f5fb1
SHA1ff06461b3f95a679352ec542cd3abefb53cdeb1e
SHA256159e71020a22eebb03495b233cf1522365f1cdfd5de24529bf186bd707688466
SHA51225e7dd7e1e9a49183e3571c500c7a3fe96ec71cbb1aeaf1e1fc9aa5b5cf492022163654e1618b72c70bacbef7c142f7acd92e732c7a5f02f86f74716d3125095
-
Filesize
55KB
MD5430eac61f61a22cc69110a391b60e2ba
SHA1827c47f270f2d09d46fb0788828a6474cc66a6fd
SHA25693fc3dfa0f33f1d9fb56783eebe9fbf00991e33ab2d6ce1b94bdea9ae71f9ece
SHA512c3107fdcd46b747dd922fd741e63aed94390e95850e745c7241e7c71db65093a55ae0929cf151f61e98dc67d4c2d3b13be7b9f879346ad428abcbabfbd156e01