1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
Size

137KB
MD5

21640f9330847c3ad96d1736bdf66840
SHA1

f8b6673a387641d14b71cd56680326b049f23214
SHA256

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08
SHA512

cf5b5961e0b9bc0723b71e750f551ca17a5b0c9ab8dad2e42f573c0bf34af81309c95d2ecd9b290427efbf7313caa714f10c804e134f10f5ac42844525b9e752
SSDEEP

3072:11i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:ni/NjO5x0Xg+UGSYnuy3Oai/Nr

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe"	sys.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	sys.exe

Deletes itself 1 IoCs

pid	Process
2820	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	sys.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	sys.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	sys.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2188	cmd.exe
2608	cmd.exe
2292	cmd.exe
2440	cmd.exe
2616	cmd.exe
2836	cmd.exe
1992	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\sys.exe	sys.exe
File opened for modification	C:\WINDOWS\sys.exe	attrib.exe
File created	C:\WINDOWS\sys.exe	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
File opened for modification	C:\WINDOWS\sys.exe	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
File created	C:\WINDOWS\sys.exe	sys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2700	taskkill.exe
2876	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442739741"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	sys.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006f6177c2444e534f92c52ef1f76589d30000000002000000000010660000000100002000000024a74f1916d397cec032deb6dd478d45aead13554f6248d236929e7cef1d958c000000000e8000000002000020000000f0b531d2fa24a40218b503c073964c5e2c771d77aae975397a941714a5507d2a900000005c3f07b2362ad470d133a1e2c4f10936d8f251522ffcb676d423ac31c9cee92ed799be178ef8bab2ec418c697a86620d7d2bc6049df3111c119cf4bf29321e72184e016b151f86424c9cf9f4b320b354181fa79b52cef02402a45152f2db14dc1fd047357091100e94ef4894e297289b51998c34425084184b3e72261de9233e2916d75b869cdf11296e91e939bea638400000006642a75fe3fd2d1563d70a05dd6830e83f39d9bf073e54e3a365457bbd370276c3eb14174bceed409c241bc5254ba8be82deb18c47662afcb87018c6b2729507	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{843BF6A1-CFE7-11EF-A742-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f010875bf463db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006f6177c2444e534f92c52ef1f76589d30000000002000000000010660000000100002000000079589dfe935d6304b9bda2fd04613ba52436dd87b57af8ce75351be9645b3dbb000000000e80000000020000200000009f1a2cd818b84ae7e07410740e30e61a26894565e06d96dbd38c8b462e4dac822000000015fecc71ffcb1d02652d10f2bf8e44fd21b5806c0bb6b33fc6908428ea630c5e400000001899d7762fc7c64ddb63c9de87ca29cb5193be6200fe6540e211101efbe2e1f046dde6d1df8a98a92814ffea2f256858797eea32b0c5c5f9dc88ff2dc36c6a6a	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	sys.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	sys.exe
2680	sys.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
2680	sys.exe
2716	iexplore.exe
2716	iexplore.exe
304	IEXPLORE.EXE
304	IEXPLORE.EXE
304	IEXPLORE.EXE
304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2700	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	30
PID 3060 wrote to memory of 2700	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	30
PID 3060 wrote to memory of 2700	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	30
PID 3060 wrote to memory of 2700	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	30
PID 3060 wrote to memory of 2680	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	32
PID 3060 wrote to memory of 2680	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	32
PID 3060 wrote to memory of 2680	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	32
PID 3060 wrote to memory of 2680	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	32
PID 3060 wrote to memory of 2820	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	33
PID 3060 wrote to memory of 2820	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	33
PID 3060 wrote to memory of 2820	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	33
PID 3060 wrote to memory of 2820	3060	1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe	33
PID 2680 wrote to memory of 2876	2680	sys.exe	35
PID 2680 wrote to memory of 2876	2680	sys.exe	35
PID 2680 wrote to memory of 2876	2680	sys.exe	35
PID 2680 wrote to memory of 2876	2680	sys.exe	35
PID 2680 wrote to memory of 2716	2680	sys.exe	36
PID 2680 wrote to memory of 2716	2680	sys.exe	36
PID 2680 wrote to memory of 2716	2680	sys.exe	36
PID 2680 wrote to memory of 2716	2680	sys.exe	36
PID 2716 wrote to memory of 304	2716	iexplore.exe	39
PID 2716 wrote to memory of 304	2716	iexplore.exe	39
PID 2716 wrote to memory of 304	2716	iexplore.exe	39
PID 2716 wrote to memory of 304	2716	iexplore.exe	39
PID 2680 wrote to memory of 2188	2680	sys.exe	40
PID 2680 wrote to memory of 2188	2680	sys.exe	40
PID 2680 wrote to memory of 2188	2680	sys.exe	40
PID 2680 wrote to memory of 2188	2680	sys.exe	40
PID 2188 wrote to memory of 2128	2188	cmd.exe	42
PID 2188 wrote to memory of 2128	2188	cmd.exe	42
PID 2188 wrote to memory of 2128	2188	cmd.exe	42
PID 2188 wrote to memory of 2128	2188	cmd.exe	42
PID 2680 wrote to memory of 2608	2680	sys.exe	43
PID 2680 wrote to memory of 2608	2680	sys.exe	43
PID 2680 wrote to memory of 2608	2680	sys.exe	43
PID 2680 wrote to memory of 2608	2680	sys.exe	43
PID 2608 wrote to memory of 1624	2608	cmd.exe	45
PID 2608 wrote to memory of 1624	2608	cmd.exe	45
PID 2608 wrote to memory of 1624	2608	cmd.exe	45
PID 2608 wrote to memory of 1624	2608	cmd.exe	45
PID 2680 wrote to memory of 2292	2680	sys.exe	46
PID 2680 wrote to memory of 2292	2680	sys.exe	46
PID 2680 wrote to memory of 2292	2680	sys.exe	46
PID 2680 wrote to memory of 2292	2680	sys.exe	46
PID 2292 wrote to memory of 912	2292	cmd.exe	48
PID 2292 wrote to memory of 912	2292	cmd.exe	48
PID 2292 wrote to memory of 912	2292	cmd.exe	48
PID 2292 wrote to memory of 912	2292	cmd.exe	48
PID 2680 wrote to memory of 2440	2680	sys.exe	49
PID 2680 wrote to memory of 2440	2680	sys.exe	49
PID 2680 wrote to memory of 2440	2680	sys.exe	49
PID 2680 wrote to memory of 2440	2680	sys.exe	49
PID 2440 wrote to memory of 596	2440	cmd.exe	51
PID 2440 wrote to memory of 596	2440	cmd.exe	51
PID 2440 wrote to memory of 596	2440	cmd.exe	51
PID 2440 wrote to memory of 596	2440	cmd.exe	51
PID 2680 wrote to memory of 2616	2680	sys.exe	52
PID 2680 wrote to memory of 2616	2680	sys.exe	52
PID 2680 wrote to memory of 2616	2680	sys.exe	52
PID 2680 wrote to memory of 2616	2680	sys.exe	52
PID 2616 wrote to memory of 1664	2616	cmd.exe	54
PID 2616 wrote to memory of 1664	2616	cmd.exe	54
PID 2616 wrote to memory of 1664	2616	cmd.exe	54
PID 2616 wrote to memory of 1664	2616	cmd.exe	54

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2128	attrib.exe
1624	attrib.exe
912	attrib.exe
596	attrib.exe
1664	attrib.exe
2032	attrib.exe
264	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
"C:\Users\Admin\AppData\Local\Temp\1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im KSafeTray.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\WINDOWS\sys.exe
  "C:\WINDOWS\sys.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /im KSafeTray.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    PID:2836
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\WINDOWS\sys.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "c:\sys.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del 1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd2c42455bbec6e55941a56bc4d288e

SHA1
d46d481673f1122101f779c1650181bbc2fbbb5d

SHA256
3bf65b8e9dfd84a272c65d96782b496ab75f7264278cda982eaa92eb94cb0143

SHA512
089479b6ebf1fa99a9fc56ed990242af5592cc6bbb878615e8d4929a2a0119fa07ed6b89cce48aae133d2f85f8a468c18b19bc7e5b30545d4c215f1e54510a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c1fe38f065098bc723135544cf220df

SHA1
532b1b1cc23399c2cbbaf867f99fa4fe7eaa42ce

SHA256
5ada7dc1dd86401770ed2c879dbae811193c03b3c949359cc2c7ec4b2f048d91

SHA512
d997e01fc827c971a6f794fe0c1079adb7a717c6bb21a18d455888d211495b5861ae43b73cce7b41628b6ce0d7c682cfe60fa2f98ecfb5678855b97df572c8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c312aabc0ae631c9c65e9a4576aa4bf6

SHA1
1c825a56821e5ff834878049f44e47bbb8073175

SHA256
efdee6bbee48eae45e3ecd93f8cbd523c6eec19b1ae3abd6a22d6594866025a7

SHA512
9a9d97d821864129b278a104917506d6bc0b3dc22a79c2d5a9c20ad290afb415c08f09c8eb491235393773cd3d780a2b6eb3ddab513d727955bbab1aaadaf200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be938950c797ee244357f1b5ba051e17

SHA1
89f46ca150e84093eb54d8b646f8970c45a7d95a

SHA256
3b56c023b60524b103dba070eef385060a7c17658f363056a7376b740d26fce4

SHA512
40c249a8f53b840be2190882a6e64263fcaee9c6f6737acc186c133011d6c666ddaad9bce1cc30d0edb050bf48dfb7bcc4a7a580f838dc5950ddbe5814c1e54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbfa5922e8639234fac73be7692f237a

SHA1
0bbabba48c8c1dcbd38c7309cfc08c0a6357035a

SHA256
609b500e0cd6ddedbeca50d85eb1544a02a9529a5559b9fdc5e8f0e5d3f98534

SHA512
aa9e3befe77f3ad912dc28ac6c7a64a317e3f614fdda7948455b87943e1141a6a012f86633a612ff3e4af711826ac8e2afeefed7b0b2efb1306cc63a27ed8260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c1ccd66837ff346b49e4ffd2174db1

SHA1
6d5f0c9aad87993528118f3c713859677d3f1388

SHA256
f9f5d5709b72613448258b87b842aae9d70737248aa06cfc944ea9bafbba2aec

SHA512
8f4d0f7e0dc6d4a461c9c589dc0ddd6b7e5c54d794c9622335e2bff0b3b8a76d0001140156b1943a451bf884ae2d8c79fb1680234e109dae9fd3149675a0635a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62dc1c75d3869a2d78deea17a170c4e6

SHA1
9be68e38a152322a8a03664d6360608e68b4c9ed

SHA256
7805427e5f050071db0186a1883d6130b3a66b1c206c7437eb7748ab24f3d16e

SHA512
15944ebe73017c5d3f05db1269c583ba10ed031bda3a94a1dfb23978dcdd9642ac15c96221f6b3eb05032ed15ae913faf25117164969337f912415105b4b3ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
359e327a8e7c7778d60b9c92870728f7

SHA1
6f9b096c802254a47548d937241e41b94e99854b

SHA256
8122e634f0611e4abf964fd6d361acea11bdb87cc4450464303e872cc7ad0881

SHA512
4d7e1355e8329bc767ae1c665c09cddaa191e1fb852c059381e01ccb9821b45cd19d9578bd9b84145497e49def07aef67bdf5b71bc63cf24b6f3460c65429ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
235220ce631423185a24b7925ffa608a

SHA1
b674d9b8d7e43635349d1b3d8130642db6509de2

SHA256
32130aed4a0875ec82bd0f4bb7aecf5e705c4c859004275d317660acbef4aba8

SHA512
22f17de726d4dfe6868cdf0bef540a86c27e68e0a04a224107092c27680301a79400e4aa30f43713fcb60fbae19f434b0a310c72b46c6079a73698b89ca4b7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c8b662bb30c9692d26d86b488485515

SHA1
698413850eb77f8e6221cf75806e9d0578cb6e44

SHA256
91251f9cbe39be5b8ada754419c50c25b847c498e1db08e53f593488020e4944

SHA512
074b0411d94359adbd56c7bf7ae21ad409b1e94804ed8f6c839ef976bcd33e9f10b5b26404a4ca04bc0d9b9c98c8a01ada177a37a501a9800e35456b2fcd6790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64072147d51376338a35891586c23c16

SHA1
9b7caa7f9769a8e80a532883b1459e16b990d3ff

SHA256
38fa2dc1bbda41959ea3859b96067f196f5b6bb82000fb20c5867a351ce7a027

SHA512
448a41568a90606e4ebb1e9a1095c85bfeb663e8379c6beb08335daea1c097aa55053fa395a9feca427a0291f328736c7be8aa38ccea4ec420ad597ce611dc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab3cb253745e13ec78a0d20d3dccf835

SHA1
26161acb0639b2fcd426b8f0b5d25a7b393f086d

SHA256
cac8fde2d05a639e50de4ee16108e798e61354bb78b3f407d559bc999b323f6d

SHA512
f01a91cad24cfc84ae81e0a41b61cea385565a40e1ce4eb40c9134d200c11b155e199c6bd541e1f957c81f6b056416492f468212461441d8f12c0377e1f92603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f131bbf8cafeb5b3d47ed1ccf5ca5cb6

SHA1
632379910d307cc52ea9fbd910d4616586ca268c

SHA256
2fa3d92c150f55419c34421a3c796e75e1bf6d1c88a440a55467042d252fce81

SHA512
fe530ad185176a1b4f5c981b3f758dfd7e70410c0bf3ea88d54c99dca74da7df88ca2797f5e15231da927d56b05df18ce08c25ba568fd2f91714dee936e4eae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f14d291f0c6010aec30c9b4d40f42d

SHA1
01583b75e4f5e7ce831305813c02a54187554200

SHA256
179a6d084db4a082b33cdaf0acf321dcdd9045b7c4d04e3acb12faf6c0555f81

SHA512
e61c56d6a92a7fbdb5ca09d82abe9b4f2f49285a2238b320f50b1d4370a0998869b3eeefba97694e42e03e020467c9425d64fbe4fecbe481db344f355efc3586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592c776c3d1d5fa5ee9807f05196ff50

SHA1
13844a64cd76dfd9a1c280f7318c4fa3ac6a6c21

SHA256
543915b993d9546d7110b87b590878d5d5a3f76c032b9fc996d54180e2327ce5

SHA512
2db560ad20ede37a7b59bc0bb5f019f8e6524a0fb1d93843cf53db5f2c24f80dea9bdfbb825aa43826c8aabb6ce346007c6e08bd3764e535300dc5f4c5e3cb02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be94779d2f490af9a81ce60cbc38ebde

SHA1
3acbf2df99b1c359d19663e24fd068795a19bc2d

SHA256
110ee06b0a13b10f176795fcbe24ff9f4ad7ea37aebc98d8b9b88f1e164d52a0

SHA512
2cccb92fa38cfa103592b7b669ef836bec7c994dfb42c8073ecedf958e62110f28b0c67a11c734049859339f171035727c5a7f210158a31413deb91a6b46879e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28e75d68874420535cc8b36b6fc3d028

SHA1
57ad231ce446eb7070b8b37ab723e3230c6dd935

SHA256
18d13e0ff1d53833aaaa186a16dc42b551303fc263859a8928b2f1282f96c8a5

SHA512
b06865c324547e1cf1265a2433c552eb86fc0b2607066d35859b640ac2c3835f65706cc12ed4bab254dbb180b16c49494786f28dac80316a7d7d8f054d8ae0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9bd1353a322aa824e5ab2f0a2adb31a

SHA1
71adc2e1f9f8de22a12a02cf95041c7ffc26cba4

SHA256
029cbecbd821cc151a9c8c0c808dafcdc82e9fa4420cdc45a8bd7a18e8cd1a46

SHA512
2aeac35b1e64aabeb4159fa3bd2269225190daaf14f1cc6ecd976e1e990fe131a473b07c053aed2161f459e2cdbdb12175c2945eaf47ec09d0a4dbe38d0cbc8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de257eecae5c3069796c8eda8996a817

SHA1
537ac6cc9a774913c7919d970ccba2b6c52751be

SHA256
f5c5df11f37d69b0b79c5696d0ec90a75a3ba637a3e8678f79706cbb952b7696

SHA512
e4f660027aa4fe342d0a7965d49fec401c7fd6083694a9837307b4bf8646f695dd46bd0ab987daa318867154ec779cc1bce949a87531591c779df055b593150c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc90dd0bc1e8037cea536328ebe6f3a2

SHA1
d44d4d718be16fed596d256bd03702bc7a344358

SHA256
15af8562edbbe1c68f150c77f82e5ac05742566f7e44b4c038ee3c16ebf840c9

SHA512
9fe8e5ff74ac3aae64b17be5e485fbfd786ac8f6f1f27683cf25521c09cc999797d4115f4faa153b7abf58c8c483461620a534f7e6bc3fc2ae0944c93c0e7ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2280.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22F2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\sys.exe

Filesize
137KB

MD5
2279e5fb9bc765cff2e000ecf8e1ac27

SHA1
8bd3e7fd9a97a4c6bf5e6493cf138f08340e3e1f

SHA256
f2362cbc3c65bf868b2412f61c08b07cea18eed8c732e61dc23c06116e02ee14

SHA512
36443ec7c85cdbc759ff3c2db2e5a5346fc462e8fe20cbece4d429eb43cbb3564f3d94aa8b6d4f8bea890518bd347e1cd7a47ddbb7c1695dde54b783a451a38f

Download Submit
\??\c:\sys.exe

Filesize
137KB

MD5
ec229d9c21b47b8ab79abb7e770a39ab

SHA1
2060113e5f7642cb16c5e52090399f266e3036c8

SHA256
cae86d76ec35b874b196f1b602e211906fec6e4598f637a7d0c8de4cd6b14113

SHA512
6b512bf2109b7bec258c85a308794febde0a2ed58f0988d42741085a64b495254f38e42079a9c0115d3cbbdd964ecdfb5da2b90f47dbd15c5f99a00e8189a774

Download Submit