928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
Size 55KB
Sample241102-xfla3avner
SHA256 928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860
MD5 64dcd323811852f8142c425098b02cf0
SHA1 a7d5d15af24e0c78541c22466574781d8acf5b4d
SHA512 f8ea3641c5436693016852d810dc77f7f07a7bd89f516d4069e1a6839e666716e0dd0b6e558b2a813d83e5da3bd293e7d7441fae00d8e4ee5534d32a1745494e
SSDEEP 1536:NhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb:VZl2zoxV1i/NU82OMYcYYamv5b
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2388	cmd.exe
2448	cmd.exe
2224	cmd.exe
1740	cmd.exe
3968	cmd.exe
4072	cmd.exe
3744	cmd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/files/0x0007000000023cc2-17.dat	upx
behavioral2/files/0x0007000000023cc3-19.dat	upx
behavioral2/memory/3048-20-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
File opened for modification	C:\WINDOWS\windows.exe	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31141207"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31141207"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400843f4572ddb01	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437338313"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1EA3AA0E-994B-11EF-A4B7-CE95CE932DF6} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4084470149"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc00000000020000000000106600000001000020000000c3d8677f9df5b218f8c4b231fc58a2b6e0c1dee4e34c5928f028b9bf2a34134e000000000e8000000002000020000000af62911e84aebd6d7fae304421f5eb3de33a2620fe6e1cd875e2d0fd348aa105200000004019b6518f23d2bd302d461ad117d21f5626f672fdfeeba5d2eb32cf2cba392e4000000059b45a0e36768face0035bf7de25d450ea1f63eb4b49117e115dbdd1a0d42517320a691c4d3a5b997cd610d5102a0ada1dbd37f73871d3ad8e281abefbb10f38	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4078510485"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc00000000020000000000106600000001000020000000fed504d9efdf9995d80dae02dc5465e71d6ea9b4429f7bf346d00af9fd1d0e32000000000e8000000002000020000000dfcaf5c9e7c75aafdc7d737390b68a001b20348d938c53c7732ed5a7ca4b553e2000000007b99f189c9fc3fc3264aaa0be5aa2509b572629230795ae666523c8f2942ca840000000f19123a97842597e2fd44de0eb1357e23f172b183444599d35a9953ef59a6e173e1b1463188f44896d636cb6f541d23f5674649f15c7aa1ca32b339f203235b6	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609239f4572ddb01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4078510485"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31141207"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
4420	IEXPLORE.EXE
4420	IEXPLORE.EXE
4420	IEXPLORE.EXE
4420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2984	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	84
PID 3048 wrote to memory of 2984	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	84
PID 2984 wrote to memory of 4420	2984	IEXPLORE.EXE	85
PID 2984 wrote to memory of 4420	2984	IEXPLORE.EXE	85
PID 2984 wrote to memory of 4420	2984	IEXPLORE.EXE	85
PID 3048 wrote to memory of 4060	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	86
PID 3048 wrote to memory of 4060	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	86
PID 3048 wrote to memory of 3968	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	87
PID 3048 wrote to memory of 3968	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	87
PID 3048 wrote to memory of 3968	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	87
PID 3968 wrote to memory of 2236	3968	cmd.exe	89
PID 3968 wrote to memory of 2236	3968	cmd.exe	89
PID 3968 wrote to memory of 2236	3968	cmd.exe	89
PID 3048 wrote to memory of 4072	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	90
PID 3048 wrote to memory of 4072	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	90
PID 3048 wrote to memory of 4072	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	90
PID 4072 wrote to memory of 1960	4072	cmd.exe	92
PID 4072 wrote to memory of 1960	4072	cmd.exe	92
PID 4072 wrote to memory of 1960	4072	cmd.exe	92
PID 3048 wrote to memory of 3744	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	93
PID 3048 wrote to memory of 3744	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	93
PID 3048 wrote to memory of 3744	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	93
PID 3744 wrote to memory of 2848	3744	cmd.exe	95
PID 3744 wrote to memory of 2848	3744	cmd.exe	95
PID 3744 wrote to memory of 2848	3744	cmd.exe	95
PID 3048 wrote to memory of 2388	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	96
PID 3048 wrote to memory of 2388	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	96
PID 3048 wrote to memory of 2388	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	96
PID 2388 wrote to memory of 3428	2388	cmd.exe	98
PID 2388 wrote to memory of 3428	2388	cmd.exe	98
PID 2388 wrote to memory of 3428	2388	cmd.exe	98
PID 3048 wrote to memory of 2448	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	99
PID 3048 wrote to memory of 2448	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	99
PID 3048 wrote to memory of 2448	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	99
PID 2448 wrote to memory of 4968	2448	cmd.exe	101
PID 2448 wrote to memory of 4968	2448	cmd.exe	101
PID 2448 wrote to memory of 4968	2448	cmd.exe	101
PID 3048 wrote to memory of 2224	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	102
PID 3048 wrote to memory of 2224	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	102
PID 3048 wrote to memory of 2224	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	102
PID 2224 wrote to memory of 1372	2224	cmd.exe	104
PID 2224 wrote to memory of 1372	2224	cmd.exe	104
PID 2224 wrote to memory of 1372	2224	cmd.exe	104
PID 3048 wrote to memory of 1740	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	105
PID 3048 wrote to memory of 1740	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	105
PID 3048 wrote to memory of 1740	3048	928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe	105
PID 1740 wrote to memory of 3488	1740	cmd.exe	107
PID 1740 wrote to memory of 3488	1740	cmd.exe	107
PID 1740 wrote to memory of 3488	1740	cmd.exe	107

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4968	attrib.exe
1372	attrib.exe
3488	attrib.exe
2236	attrib.exe
1960	attrib.exe
2848	attrib.exe
3428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe
"C:\Users\Admin\AppData\Local\Temp\928bd52cd059a6920a1c62ef197b84319d23004d7d1d8efb65661ed078e26860N.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4420
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 8b02c3ca024f175678196dd201e9b86170f403597411708e6f3781d0be3a213d
MD5 fc8856535e3bc8916e8ba168541e5e4e
SHA1 6aec8d612d823f6b2579e822e04c95a41fe4d50b
SHA512 11cc850c4ee3c3a002f770745092fd483b3b5a256f10f654e72579722f08c8ea5e44dc6d1ed674fd136e19c8f56924387b664312accf444308e18e716995ae5c
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 57a2afa306d879f1027aef7a2cee22c9131f2d59ee738a58faee5b00b707a494
MD5 5b1cbb383677564597d5d45a42112a08
SHA1 6304a5b5283cf84882c9a7211c0d9d75df4cf414
SHA512 32afc9e42a787a3b3f635f2f6007de3fa618bb03144766a1da02ed10a342e6103728cbf50cbf82663c9acce146dd40c24bf29c2530c58b4e31f9bb06eab9369e
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows.exe

Path C:\WINDOWS\windows.exe
Size 55KB
SHA256 70b097b596313175e1cd3dcc75eeb8c1e5ed764464eb7771ba689c258d5e3f03
MD5 1db5a715f3849dfaee15b370ba0bd208
SHA1 9525382e617b87993b0e8607933a7bcdbc0c5206
SHA512 ca790b9f07adcea4b87f6f14012cbb617345a050672f3d4f56cd1c6e255d4dc9f90a5739ee3371afe8bb3973b124cb19123b3d11f2fc29440f62b06cf8befddc
SSDEEP 1536:hhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb:RZl2zoxV1i/NU82OMYcYYamv5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\system.exe
Size 55KB
SHA256 a8db81925bbe747e2a026bba2d194337aefe765f7835fdf7faf8a2bffa66a276
MD5 39eab1bdb4af0dc2910143637bccf9b8
SHA1 983aee9062044500e035cfc5589d0fcbc9f1d24e
SHA512 7d9f10f4aa7f343c60f7a215ec3e0708091ae223a552adfe9ae9513fb479c757023026751f4f42591b4e8b87dd41fcf353a9c4f90788cb9d930c937bf21199b8
SSDEEP 1536:chBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb:IZl2zoxV1i/NU82OMYcYYamv5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3048-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download