Analysis
-
max time kernel
130s -
max time network
129s -
platform
windows7_x64 -
resource
win7 -
submitted
14/07/2020, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
RUN ME.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RUN ME.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
RUN ME.exe
-
Size
888KB
-
MD5
323c3c28b793f084ede6cb8becb4c4d2
-
SHA1
ca2bceb5658be20cbe08ca96a32dcccb22b98dcc
-
SHA256
8a5c7b6b363eaeff989b00c2664a92831b00133064339208f69d050ff55f004a
-
SHA512
376bc71a467060c5378a659ed5d21b96e1a18f6cb551e9a93cf290a2a6057e3a7fb0be0c4a9a01d0485dca0bc8450dd7228407ef1e51502efe9c9c13f0f55d44
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000105d4961b1e06837d340247b6687c767277b1c34a3f736e7abe10f3f9fd82cfa000000000e8000000002000020000000086a36bffcba71855fec4042c17930df68730fe7ba0a322cd6a648d26147d9d82000000001e8201f57747b660ef5bde915e56bd95feae863906c090bb4b30632eccce2f64000000017b3942903304e1461a46574071764de2bfdc0b25584d308ce79ee2e7612fa494eb734c65e6d62895a34b33a3170d86faf2e4409441db835f7757ed0dcda3479 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab80000000002000000000010660000000100002000000082746e722d96efe40128edbd4f3747c6d57d166e5c6242629d1551afbb9d6a40000000000e8000000002000020000000f855ea9c1fa5d922f6b32689d12fb3d4e80df64774af031912b112908888d64c90000000c5bc7c565216fd39ac6721dab29201a49c5fff7857c84d9730e5d69adf3350388334c9976ccb1e70a3770871d3804330f48098e29db94289c48dba670aea195aaef72a881287a7eb669b138b1052e878b05e0339c99918a3f50af502e3fbded61fbd6f08de019d1124ff0ac112c9da17ea3ca7180c2429a334d5b267c7b64bb3ec9ef8d6b94afd487965df35665c1f5940000000859eb354b1589f7e783ee90bfe86c6fca31058bdbbca075660c07e881aca68b6e7df10a1228ac7d414b31d42a4bef05dfa8e6496ec09cb7a1a7fa988a7fea5b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7E7EEE1-C5E3-11EA-AFE2-F6459340E2F6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dad38ef059d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301504217" iexplore.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1116 RUN ME.exe 1116 RUN ME.exe 608 iexplore.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1768 msdt.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe 1116 RUN ME.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 608 wrote to memory of 1636 608 iexplore.exe 26 PID 608 wrote to memory of 1636 608 iexplore.exe 26 PID 608 wrote to memory of 1636 608 iexplore.exe 26 PID 608 wrote to memory of 1636 608 iexplore.exe 26 PID 1636 wrote to memory of 1768 1636 IEXPLORE.EXE 28 PID 1636 wrote to memory of 1768 1636 IEXPLORE.EXE 28 PID 1636 wrote to memory of 1768 1636 IEXPLORE.EXE 28 PID 1636 wrote to memory of 1768 1636 IEXPLORE.EXE 28 -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 608 iexplore.exe 608 iexplore.exe 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 msdt.exe -
Checks whether UAC is enabled 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\RUN ME.exe"C:\Users\Admin\AppData\Local\Temp\RUN ME.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1116
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1636 -
C:\Windows\SysWOW64\msdt.exe-modal 65890 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF60D4.tmp -ep NetworkDiagnosticsWeb3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: GetForegroundWindowSpam
PID:1768
-
-
-
C:\Windows\SysWOW64\sdiagnhost.exeC:\Windows\SysWOW64\sdiagnhost.exe -Embedding1⤵PID:1700