Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
18-02-2020 16:38
Static task
static1
General
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com\Total = "52" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "414" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "688" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "49" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30795394" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\embedly.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure-assets.rubiconproject.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000671cc77501b1bb4a8c8ac6fabaa4446c0000000002000000000010660000000100002000000060dd9c752c0af5c24b0158c1201cda53697960358d54e274f5ce8a0e57b94d44000000000e8000000002000020000000451eb3f6327bedb8520c9be0a48f0349fcfc5fcf7c780c6808120b496086c57a20000000b6f6cc778fc161fec816610ce45488219c58e42821db49ccaadde35c8cc8caf1400000000e03bceb83be4cef867fd04c5a100526a8dbac5e303dc7d04edc4912751cec96b17032e2d364359d7c8507c0e82fdce275baa94bce6c542bf9af2ddb42885148 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "52" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "394" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com\Total = "182" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "49" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80498b7482e6d501 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "954" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1302833710" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure-gl.imrworldwide.com\ = "52" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\cdn-gl.imrworldwide.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "626" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "772" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7710B28C-5275-11EA-B6A1-F669055977CC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com\Total = "62" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "414" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "582" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "626" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bbb77582e6d501 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\ = "336" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "446" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "644" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com\Total = "45" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "49" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "336" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30795394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\secure-gl.imrworldwide.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\rubiconproject.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30795394" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\7news.com.au\Total = "406" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\embedly.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Internet Explorer\DOMStorage\imrworldwide.com\Total = "101" IEXPLORE.EXE -
Processes:
IEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030753000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 IEXPLORE.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE IEXPLORE.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob = 5c000000010000000400000000080000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000005c00000047006f006f0067006c00650020005400720075007300740020005300650072007600690063006500730020002d00200047006c006f00620061006c005300690067006e00200052006f006f0074002000430041002d005200320000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0620000000100000020000000ca42dd41745fd0b81eb902362cf9d8bf719da1bd1b1efc946f5b4c99f42c1b9e1400000001000000140000009be20757671c1ec06a06de59b49a2ddfdc19862e1d000000010000001000000073621e116224668780b2d2bee454e52e7f000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d50103000000010000001400000075e0abb6138512271c04f85fddde38e4b7242efe2000000001000000be030000308203ba308202a2a003020102020b0400000000010f8626e60d300d06092a864886f70d0101050500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3036313231353038303030305a170d3231313231353038303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523231133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a6cf240ebe2e6f28994542c4ab3e21549b0bd37f8470fa12b3cbbf875fc67f86d3b2305cd6fdadf17bdce5f86096099210f5d053defb7b7e7388ac52887b4aa6ca49a65ea8a78c5a11bc7a82ebbe8ce9b3ac962507974a992a072fb41e77bf8a0fb5027c1b96b8c5b93a2cbcd612b9eb597de2d006865f5e496ab5395e8834ecbc780c0898846ca8cd4bb4a07d0c794df0b82dcb21cad56c5b7de1a02984a1f9d39449cb24629120bcdd0bd5d9ccf9ea270a2b7391c69d1bacc8cbe8e0a0f42f908b4dfbb0361bf6197a85e06df26113885c9fe0930a51978a5aceafabd5f7aa09aa60bddcd95fdf72a960135e0001c94afa3fa4ea070321028e82ca03c29b8f0203010001a3819c308199300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604149be20757671c1ec06a06de59b49a2ddfdc19862e30360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742d72322e63726c301f0603551d230418301680149be20757671c1ec06a06de59b49a2ddfdc19862e300d06092a864886f70d01010505000382010100998153871c68978691ece04ab8440bab81ac274fd6c1b81c4378b30c9afcea2c3c6e611b4d4b29f59f051d26c1b8e983006245b6a90893b9a9334b189ac2f887884edbdd71341ac154da463fe0d32aab6d5422f53a62cd206fba2989d7dd91eed35ca23ea15b41f5dfe564432de9d539abd2a2dfb78bd0c080191c45c02d8ce8f82da4745649c505b54f15de6e44783987a87ebbf3791891bbf46f9dc1f08c358c5d01fbc36db9ef446d7946317e0afea982c1ffefab6e20c450c95f9d4d9b178c0ce501c9a0416a7353faa550b46e250ffb4c18f4fd52d98e69b1e8110fde88d8fb1d49f7aade95cf2078c26012db25408c6afc7e4238406412f79e81e1932e IEXPLORE.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 IEXPLORE.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
IEXPLORE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz IEXPLORE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3952 wrote to memory of 3908 3952 iexplore.exe IEXPLORE.EXE PID 3952 wrote to memory of 3908 3952 iexplore.exe IEXPLORE.EXE PID 3952 wrote to memory of 3908 3952 iexplore.exe IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3952 iexplore.exe 3952 iexplore.exe 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE 3908 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3952 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
IEXPLORE.EXEdescription pid process Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE Token: SeShutdownPrivilege 3908 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3908 IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://7news.com.au/travel/coronavirus/coronavirus-scare-in-bali-as-chinese-tourist-tests-positive-on-return-home-two-in-isolation-c-6948161⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3952 CREDAT:82945 /prefetch:22⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies system certificate store
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NN4A830X.cookie
-
memory/3908-6-0x0000000019090000-0x00000000190A0000-memory.dmpFilesize
64KB
-
memory/3908-4-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB
-
memory/3908-5-0x0000000019090000-0x00000000190A0000-memory.dmpFilesize
64KB
-
memory/3908-3-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB
-
memory/3908-7-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB
-
memory/3908-8-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB
-
memory/3908-9-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB
-
memory/3908-10-0x0000000019090000-0x00000000190A0000-memory.dmpFilesize
64KB
-
memory/3908-11-0x0000000019090000-0x00000000190A0000-memory.dmpFilesize
64KB
-
memory/3908-12-0x000000000AEF0000-0x000000000AF00000-memory.dmpFilesize
64KB