Overview
overview
3Static
static
32024彩虹...4.html
windows7-x64
32024彩虹...4.html
windows10-2004-x64
32024彩虹...ate.js
windows7-x64
32024彩虹...ate.js
windows10-2004-x64
32024彩虹...cle.js
windows7-x64
32024彩虹...cle.js
windows10-2004-x64
32024彩虹...ods.js
windows7-x64
32024彩虹...ods.js
windows10-2004-x64
32024彩虹...ist.js
windows7-x64
32024彩虹...ist.js
windows10-2004-x64
32024彩虹...tor.js
windows7-x64
32024彩虹...tor.js
windows10-2004-x64
32024彩虹...kms.js
windows7-x64
32024彩虹...kms.js
windows10-2004-x64
32024彩虹...ite.js
windows7-x64
32024彩虹...ite.js
windows10-2004-x64
32024彩虹...dit.js
windows7-x64
32024彩虹...dit.js
windows10-2004-x64
32024彩虹...dit.js
windows7-x64
32024彩虹...dit.js
windows10-2004-x64
32024彩虹...log.js
windows7-x64
32024彩虹...log.js
windows10-2004-x64
32024彩虹...min.js
windows7-x64
32024彩虹...min.js
windows10-2004-x64
32024彩虹...ist.js
windows7-x64
32024彩虹...ist.js
windows10-2004-x64
32024彩虹...age.js
windows7-x64
32024彩虹...age.js
windows10-2004-x64
32024彩虹...der.js
windows7-x64
32024彩虹...der.js
windows10-2004-x64
32024彩虹...ice.js
windows7-x64
32024彩虹...ice.js
windows10-2004-x64
3Analysis
-
max time kernel
35s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 14:59
Behavioral task
behavioral1
Sample
2024彩虹二次开发虚拟发卡商城源码/404.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024彩虹二次开发虚拟发卡商城源码/404.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/appCreate.js
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/appCreate.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/article.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/article.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/batchgoods.js
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/batchgoods.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/classlist.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/classlist.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/editor.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/editor.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/fakakms.js
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/fakakms.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invite.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invite.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/inviteedit.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/inviteedit.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invitegiftedit.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invitegiftedit.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invitelog.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/invitelog.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/jquery.dragsort-0.5.2.min.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/jquery.dragsort-0.5.2.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/list.js
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/list.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/message.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/message.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/payorder.js
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/payorder.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/price.js
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
2024彩虹二次开发虚拟发卡商城源码/admin/assets/js/price.js
Resource
win10v2004-20241007-en
General
-
Target
2024彩虹二次开发虚拟发卡商城源码/404.html
-
Size
36KB
-
MD5
6493fe560ca6f25a2dd625046ea03174
-
SHA1
2cf94ee0f4e0b2874aee66cbf79336fe732148bb
-
SHA256
41541385eead7a5e66d906880e8f8e8848285156176396bc4e3538d4b040041c
-
SHA512
1d8f5c9d2c624f20c031bc1449c3fe451ece02c3b23a34be1b7247e792a16becea3bf28de40221e904ded0b6d9aa88d0caf9c7117479c36b86488aeaf8d8a1b8
-
SSDEEP
768:oO946tCXstQ4G44XWtPNXSKQ4/Xm4prA4x4MK0ryrntUKaKJ4ItBr1XtrC4T4sro:B46tCXstQ4G44XWtlXSKQ4/Xm4prA4xt
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08F42651-9862-11EF-B1BD-EAF82BEC9AF0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2500 2060 iexplore.exe 30 PID 2060 wrote to memory of 2500 2060 iexplore.exe 30 PID 2060 wrote to memory of 2500 2060 iexplore.exe 30 PID 2060 wrote to memory of 2500 2060 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2024彩虹二次开发虚拟发卡商城源码\404.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50e243ffe064fc3bf4c54ab3aeb3c5f9b
SHA1ade24076ccb406b5d76d157f95afaa27ea34afda
SHA256dd72c20dd2263dc0f325053a08d2c2f1d8f777d3f2b723fb7b9a76789224423e
SHA5126ef5c2921ead485fe87690a4bb96d861b778c4ba91d504ce008e41bd2bedb1ae2539ad81403a0a6d5634ad275eebfa4219cca96bafc3d8f5a8336155a32fa5b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54446206235c781bf589fc47aa00d9290
SHA1d54ca4aa29cb0c1d6a814a31e3e8d9d9101a2ada
SHA256ce2fdfbd11e1e0c6de529160eae3afc03f5305a0ab0a8bea12c4ba88763fdba6
SHA512fa4b78e4f329b19e7c2b4cfb08d385f2d59562313eed95eb93ce02d1282f6e09e34271b192470df6f7c69850172f33a74056aa635d730e00a8bac4a6f07d107b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547475f4989c9e9109fea171eb4ed0ae8
SHA16a9bd25b07968f33b94de7b3dd6534dbb3761af8
SHA256109592f64039f26276a244b540b6f86b14ea075017e925042ac7644374b54423
SHA512ab2da505842dc13d0e711167e5e141c346afc1179d719a9342828231682dc8790f4142e5f7525deef7779a5f836585b5919df48f6f22bb066caca5bbf74c6a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a222690ec68dd5a8a182a251423e1c5
SHA191996d7f5057bd0daba3bcd5a92c7b32fecf2105
SHA256b14427f435174f97ad7c01f922574680ab9df9b617f05ec12f95adff11718b7f
SHA512613df54b6694f8a1fe14621def483ef03b9bc3ae220f149997f64cfdecf7feac3dc7ea8fcdf74de2c407e8c9b7cbcab350c6169c3b8baa9fb912601eac4041e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5996ebf822f57d86f7734c668624d7b3d
SHA1efd3aa9baf9029e70fe2ccec2193d500775a7920
SHA2563951a6dad490a910ea4a8a95a7d789b7c76371cf5632f74dc59bd2d3f399e1bf
SHA5126c452edbe0e51e5098c64bb3aaba977c326b3e5afb0b883d7fb98137643029c021cde6448eac62081ad7b0a848cd483b5aafbf1dccc4484d08bb0d2e70903bcc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b