Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1Analysis
-
max time kernel
394s -
max time network
379s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:28
Static task
static1
Behavioral task
behavioral1
Sample
bootstrap.min.js
Resource
win10v20201028
Behavioral task
behavioral2
Sample
cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
ch/index.html
Resource
win10v20201028
Behavioral task
behavioral4
Sample
ch/jquery-1.js
Resource
win10v20201028
Behavioral task
behavioral5
Sample
ch/retreaver.js
Resource
win10v20201028
Behavioral task
behavioral6
Sample
chrome-assests/a.html
Resource
win10v20201028
Behavioral task
behavioral7
Sample
chrome-assests/ie10-viewport-bug-workaround.html
Resource
win10v20201028
Behavioral task
behavioral8
Sample
chrome-assests/iframe.js
Resource
win10v20201028
Behavioral task
behavioral9
Sample
chrome-assests/img-1.svg.xml
Resource
win10v20201028
Behavioral task
behavioral10
Sample
chrome-assests/img-11.svg.xml
Resource
win10v20201028
Behavioral task
behavioral11
Sample
chrome-assests/img-12.svg.xml
Resource
win10v20201028
Behavioral task
behavioral12
Sample
chrome-assests/img-2.svg.xml
Resource
win10v20201028
Behavioral task
behavioral13
Sample
chrome-assests/img-3.svg.xml
Resource
win10v20201028
Behavioral task
behavioral14
Sample
chrome-assests/img-4.svg.xml
Resource
win10v20201028
Behavioral task
behavioral15
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
hyundai steel-pipe- job 8010.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
ie.svg.xml
Resource
win10v20201028
Behavioral task
behavioral18
Sample
index(1).html
Resource
win10v20201028
Behavioral task
behavioral19
Sample
index(10).html
Resource
win10v20201028
Behavioral task
behavioral20
Sample
index(11).html
Resource
win10v20201028
Behavioral task
behavioral21
Sample
index(2).html
Resource
win10v20201028
Behavioral task
behavioral22
Sample
index(3).html
Resource
win10v20201028
Behavioral task
behavioral23
Sample
index(4).html
Resource
win10v20201028
Behavioral task
behavioral24
Sample
index(5).html
Resource
win10v20201028
Behavioral task
behavioral25
Sample
index(6).html
Resource
win10v20201028
Behavioral task
behavioral26
Sample
index(7).html
Resource
win10v20201028
Behavioral task
behavioral27
Sample
index(8).html
Resource
win10v20201028
Behavioral task
behavioral28
Sample
index(9).html
Resource
win10v20201028
Behavioral task
behavioral29
Sample
index.html
Resource
win10v20201028
Behavioral task
behavioral30
Sample
index2.html
Resource
win10v20201028
Behavioral task
behavioral31
Sample
infected dot net installer.exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
inps_979.xls
Resource
win10v20201028
General
-
Target
index(2).html
-
Size
6KB
-
MD5
6ab776dc484b17397ad580be04b00a54
-
SHA1
f3058f8c46c45af5baa46ee09dd3979c100fffe7
-
SHA256
e8be9982165aa8f2b44c3bc3ac6fce1faa03266fee0a0a223433e18f18cc60cc
-
SHA512
8259e1848fabcd0dcbe114021d1033faf766607f1955e9bd5f5b70c791bb8b2347db73dfd7672ea3c68ff490674b971424cbc5ea5bc77b243f2ed59ae22e2f6d
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2254298468" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9020c88798c0d601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000b4bf64ccc911277441bb1308367ef76db4856823bf9f23491f663ecc48c195b4000000000e8000000002000020000000ea329d765a92d0f403633b745dfffba756d0679a758b686bf1cca161c4cce5b120000000c319a1df3048e9fca5721e19953a82b1fd7f843116be876ef1dff2f4597d8cc4400000001e3161aa0761fe7bf81e71483a78fa29e57c18640edbb07fc2cadbcf3b1a0b3f70ef19b448d2de9b63d6f86d1331980c72c4a9efa215e677632805155e993b41 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7007d48798c0d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30851224" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000c0a9ce796d96eeffff2a0424d70d50514285902ef0a8b97d939eb04e9e343ce7000000000e8000000002000020000000492bb5587347b40d62e7902f69d2e59ce5f25e5df90caa1f93942c71f377b49a200000004d94dadbe10e8840716fcf3f940e52c2978630b8069936c9902a2c5081e2ad3340000000514a2a0542613f9aacf0103e3dc2cd149b68fb70b65a4536cecca83d0fce78703ce33b752e8c1c29eeeb41f093171b4459878ab4c4fb31b65146c1e5f10664f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0A66310-2C8B-11EB-BEBD-CA79033726AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30851224" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30851224" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2236641992" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312791380" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "312839966" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2236641992" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "312807974" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3108 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3108 iexplore.exe 3108 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3108 wrote to memory of 2216 3108 iexplore.exe IEXPLORE.EXE PID 3108 wrote to memory of 2216 3108 iexplore.exe IEXPLORE.EXE PID 3108 wrote to memory of 2216 3108 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index(2).html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3108 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203MD5
4fd1154dbee8bda008d2a2ff53240855
SHA129913132808f93bb89583082786ca080b6609a1f
SHA256f0643a2bc9668f5378bb84f7302b925073d18374648e1d33624c88c149b9370d
SHA51262739cb9df68299ee11ebbbcded36a7cc821d8a3b08e1fa0e84969340338e904feb320079e0dc10a8cd3fce33ffbe21dff569333a801aa8edbf776fb4285b235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203MD5
5600ba092df48e598ded7a5f86a9e28d
SHA10a7fe3912ad17d60d1ee6999def6bd16e332f289
SHA2569ddfac214335f353d064553153edda4ccf22571c2b25ef66859b4513191dd700
SHA5123aeeef623bc9d00bb99a889b19734846bdd0caa8c373a4878663062f7eeafe7f3f87429437171fdda814b4caa4ea537a2531c9d8e55fc977460283d38bf5db5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\B1XTJKR3.cookieMD5
b544f0d250b263b239013dcef7bf12c5
SHA1df11c6618f7178b455b7fa1823e1d17f85eb2a02
SHA2567d6b3199d4e513c31e0c7bfebb3033e25d9a982d808bc86f3fe8891e34b1e05f
SHA512e30e16792ab52c240eef4cbcf4da011e6a22e02861fd46bc8debdf1961f74050b2fcaf8adad9189792498c7cc27f91bd02cd930f793597101e0d1110ae202bba
-
memory/2216-0-0x0000000000000000-mapping.dmp