Resubmissions
05-05-2021 16:30
210505-lda1w1hczj 105-05-2021 15:22
210505-prcssfb9m6 101-05-2021 12:52
210501-l7d8w6sgc6 1Analysis
-
max time kernel
136s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-05-2021 12:52
Static task
static1
Behavioral task
behavioral1
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win10v20210408
General
-
Target
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
-
Size
19KB
-
MD5
5aac519e51e8d443bd6d50d8f4221ea0
-
SHA1
2649e34827acbdd93913b39ab35011fab2830233
-
SHA256
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42
-
SHA512
9582fc5a96d696652064a831f7fe0296c36210fb34ca946182cddbbe4b95ea37ad18a8870283f7289e527ecaba04a736a93c1e0afd113b3ceb974a3192ce4bd2
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4EFA791-AA7B-11EB-A787-52BBEA82F32C} = "0" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 744 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 744 IEXPLORE.EXE 744 IEXPLORE.EXE 560 IEXPLORE.EXE 560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXEdescription pid process target process PID 620 wrote to memory of 744 620 iexplore.exe IEXPLORE.EXE PID 620 wrote to memory of 744 620 iexplore.exe IEXPLORE.EXE PID 620 wrote to memory of 744 620 iexplore.exe IEXPLORE.EXE PID 620 wrote to memory of 744 620 iexplore.exe IEXPLORE.EXE PID 744 wrote to memory of 560 744 IEXPLORE.EXE IEXPLORE.EXE PID 744 wrote to memory of 560 744 IEXPLORE.EXE IEXPLORE.EXE PID 744 wrote to memory of 560 744 IEXPLORE.EXE IEXPLORE.EXE PID 744 wrote to memory of 560 744 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"1⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:744 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-64-0x0000000000000000-mapping.dmp
-
memory/744-63-0x0000000000000000-mapping.dmp
-
memory/1116-59-0x00000000012C0000-0x00000000012C1000-memory.dmpFilesize
4KB
-
memory/1116-61-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1116-62-0x00000000009F5000-0x0000000000A06000-memory.dmpFilesize
68KB