c896123aa5ab5f9d99e90e14b6ca824a8ad1a436eb6daa17078a023c3b6fcd71

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

十彩0909正式版/十彩Vip-0909.exe
Size

9.9MB
MD5

38dc1561f2dc0a3881ccd406479363a1
SHA1

c890820de9148a5742cd415e943f2e7a61d1c056
SHA256

a66a10ae27c74aa0960b68f92a0c8d76dc63fe08cf5637dc7ff119dc2bae403a
SHA512

a5ecdaec4c7673865cb1a731f02264f60c5ed938266a3a83527a95a32bde9b63e4012757f0b11da842d7b8b44b0c631aecdc387e5eb6816a254ee90c816ff743
SSDEEP

196608:REky+XOrki0MWT4jrQG4jywuqvtf2pt4jVWNR0dm73rYGa1RBAycRryo3YN1irx1:OJLIh7K456RaMrYGa145VPYN1irxviN6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	十彩Vip-0909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDF0EE41-AA42-11EF-BEB7-46BBF83CD43C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438600859"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2116	十彩Vip-0909.exe
2116	十彩Vip-0909.exe
2116	十彩Vip-0909.exe
2116	十彩Vip-0909.exe
1308	iexplore.exe
1308	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2520	2116	十彩Vip-0909.exe	30
PID 2116 wrote to memory of 2520	2116	十彩Vip-0909.exe	30
PID 2116 wrote to memory of 2520	2116	十彩Vip-0909.exe	30
PID 2116 wrote to memory of 2520	2116	十彩Vip-0909.exe	30
PID 1788 wrote to memory of 1308	1788	explorer.exe	32
PID 1788 wrote to memory of 1308	1788	explorer.exe	32
PID 1788 wrote to memory of 1308	1788	explorer.exe	32
PID 1308 wrote to memory of 2260	1308	iexplore.exe	33
PID 1308 wrote to memory of 2260	1308	iexplore.exe	33
PID 1308 wrote to memory of 2260	1308	iexplore.exe	33
PID 1308 wrote to memory of 2260	1308	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\十彩0909正式版\十彩Vip-0909.exe
"C:\Users\Admin\AppData\Local\Temp\十彩0909正式版\十彩Vip-0909.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "http://www.jjmm55.com"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.jjmm55.com/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4d4d6189082764c951dfb0ba5cc99d2

SHA1
4b74446f6e0d4ee863c441eac3eecbcd16b3181f

SHA256
f700de1919995d44fa049ab8986c72fdc261054f674e58d7329c27967ce7e70d

SHA512
1eb67349686410a85668bd955aee71e6e497659f4ad29493111ad40c89c2ab7d30afdda1f6a0eb951dbd85047402d49c084e2cc19417c3c94bb4b4593ea45794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5589ede0c0b872a062437db26e0f6808

SHA1
0db50aba56c0c15a2a1f0734ff20c745235b4056

SHA256
3ec97f36c573a43ad3e64dd5c82eb2cdf5eb720c35d68516d59be7a551110a2f

SHA512
f9b52be5902f5b03793965b207b17429fbd39c36cccc7edbf5e199b7e48c6d8303d59d15770de0da94065464338990927f14afab337c5edf3da3a964fe807f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
501b54a5220028a418986a2e4abadff7

SHA1
680506f2b8dd6d3ba3c82d12bac3728a860676de

SHA256
1fb02dda685d4b8201cbc9fe7fd68c5c94570c1dbe82c3dcc742e7416e22b586

SHA512
e6c13742bc0ca4a5a12ca6b3abbcca6defe85337a20ec58af7f12b38615caae82a28ff2f2ba4d52a0df1e813fb78d30fb492ec59c94caf6953f1b8ca5cded295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454300a056d2440bfcfe66194cc3aa50

SHA1
11b18a1748d23b05d63c19eab7dd57d7f38e7922

SHA256
c01d71edaeb3a92c486c73e952928743431e1b1fe6c3acc380188f0694bf1fad

SHA512
b10a97193b2d8fd1296776289fddc5b146e1bbc5a6b46063128a431aab898cda3705c6958ed7456b431e3b8653a5a473154e2d52939b79f1b2ef161716b831d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65de4a9e56acd95ae4f8acf26cdf6768

SHA1
7217e22b6b3eb3c8907d73fbbf569db47ec7dc19

SHA256
9c663314d28c7a189d70da3113f4898327d76d50cdee17bdff9fcf0e576f4110

SHA512
9158246fd39069057a24e42d15892d03d331e653958a7e43b0f1e2238f8c9471f661de03c878861e08d70713064429f10e0b361db5b44c0759b1ea2bd40dcb74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe2b97d1aec4213bb20a6f8ad2cd858e

SHA1
64a893e71218d3b71f7eac240262763506dc63f7

SHA256
8552b0c9a19321372725152e010bed1ca9b0ce98e20f8558ef691a980ebcf3b8

SHA512
9b5c6ce2d2c965db836e363b7431ac4d4bffcecdf03c58bb71c3eba7359a399e558fd7c0ffbf6c3a54b931e8206ae243f4e5337339b0bd4d1d9f401618531a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67adb90e96f69b7f92cc17dae8b1786d

SHA1
644d38a93041617d770c277ef9920ed5e8d34895

SHA256
fda4e4f1b891e9105cf51ad732ee6039841d223722be57eef422e4f1a2f3d1f1

SHA512
925546a03741788c080269e21b323e366284149a352a5fa503fa4adef59d84a2f689abc80b8fe463ec873661a0067d025edf3cbc4a4d04f284f48eb1c632f99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cdfd3b55b325d27e94b542e51ed5dba

SHA1
be0f83547c9aee1dc5c93e55c406ee34ba607553

SHA256
dce3b0bde37b7d44ee94b90ac0a686dec65b9dcd3fb9ca8b11d62da09215be88

SHA512
e2e3c6a317c60f6600d6addbd0fc8ed00c433bc71d8658810b183ea290c27993c21e6cbb48f3a3e3d32a865e5d165640a9a90ae1ed6943270539b0d3cc72d9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbfe40b9f8a34b11b805d9d9948f34cd

SHA1
6bb075bc07dca49447e0f14057576d512cd89b3f

SHA256
4ac161660fad2da75a28d8482f3717737e61e6d5964b2316551eccb7de77b4a0

SHA512
a67dbee57b22abd97da910a67b08c0c813c8c6463ecad541dd1947af32675e371b9707ec2386028ecb6fff337666940fffe2eb4c1f37b03991e406a13f512bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9589cfd9d8fd37c4a205df792f795030

SHA1
4476f8dbe49c90f2e4d074c06aa4b56fc83f5d4c

SHA256
fe6ee42b051e31247dd00b098f5e741ec7ee12db58f173810f2561fbc4d76856

SHA512
a42c2b61ebfdf376f8a490e0a38c5d78466fead049780a940cd25653f57c635dbc450942d77ae6ce952428ddba91e26b57b30b968607215490addf8fbca8c68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA07.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAF5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit