Analysis
-
max time kernel
46s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-11-2020 16:11
Static task
static1
Behavioral task
behavioral1
Sample
MCreator.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MCreator.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
MCreator.exe
-
Size
1.3MB
-
MD5
30319ffa5f32cc5c5c343542907f9281
-
SHA1
f393a48afe20c4c90236f4e5c95d6d6f9ed9a727
-
SHA256
4caba634924bb3b457b85f63abc5163139f7215f09a31a34857115666823a95b
-
SHA512
aae98f6f64387e486e8d35ab9c238d284db0f485e8cac24ac80e5252e1ab74594f5397f1702e79451808389a5fa96cd8be83ff762dfd1e14012e4b9e3ca909da
Score
1/10
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b6600000000020000000000106600000001000020000000c51381b96f8169104b5593d64de2a1c5f923196793d418e35107aee5e78b627e000000000e80000000020000200000009f9aeac194eab6c010efca06cfecb0180e431b83134ab3d2b0965ec688aeb16220000000cd0643a450b12d1438ac148e74846b084ceda966a975d503b754960aadd01d2240000000ad94288a13713c17947323034ee16ae5a5dc6e213954a4e6af30c7bd75f733e6d5b3083a4609394d5ea5f2e9277719e0d0d290bf5e3b1ad22f1c696960d87be5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bd9aea29c0d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1061DBB1-2C1D-11EB-A3A5-424ABE5A776C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b6600000000020000000000106600000001000020000000066c32aa4bec78ff766c88fab206692d7edb2ea85aa8a3c7c1872f5d0cfb5739000000000e8000000002000020000000838a9e0851d2dd74e4c44d7e714ab546ffc0741d60ab9d642de369d01001db0790000000e184a401bb495f0e084d34b753c85b5f33ea14d2af1677fe0c94f3fce41a72983c53fe512545dd8fd2f641efcfc297b8e6d87a93bedca5b1632285828adc645089694e9cb7678dc80659ed65c3b4428b2702e605819cddfd6d43fb869e1606f2ef520a440c9badbab3c06e113b92bfb0abb73e127b07fa0f45770911c2071a348d5045f773eb7bc7988ef906f64837b240000000079614a4bd36962b5446863367b48c353923e08670165ce53198082a4ad88415744169e72b14639a45aa81c1572d7b56bd5f436e1cb1ff464cb6ae1ff69b1d93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1724 iexplore.exe 1724 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
MCreator.exeiexplore.exedescription pid process target process PID 1688 wrote to memory of 1724 1688 MCreator.exe iexplore.exe PID 1688 wrote to memory of 1724 1688 MCreator.exe iexplore.exe PID 1688 wrote to memory of 1724 1688 MCreator.exe iexplore.exe PID 1688 wrote to memory of 1724 1688 MCreator.exe iexplore.exe PID 1724 wrote to memory of 1704 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 1704 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 1704 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 1704 1724 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\MCreator.exe"C:\Users\Admin\AppData\Local\Temp\MCreator.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://mcreator.pylo.co/page/report-bug2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-1-0x000007FEF7080000-0x000007FEF72FA000-memory.dmpFilesize
2.5MB
-
memory/1704-2-0x0000000000000000-mapping.dmp
-
memory/1704-7-0x0000000007680000-0x00000000076A3000-memory.dmpFilesize
140KB
-
memory/1704-8-0x0000000005430000-0x0000000005432000-memory.dmpFilesize
8KB
-
memory/1724-0-0x0000000000000000-mapping.dmp