Analysis
- max time kernel
94s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
04/08/2021, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
9cd1d24d-c3c1-4fdb-a561-46c1e12ec210.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9cd1d24d-c3c1-4fdb-a561-46c1e12ec210.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 9cd1d24d-c3c1-4fdb-a561-46c1e12ec210.exe
- Size 544KB
- Sample210804-cgdckvhmf6
- SHA256 7b12482461a70f778d09799479ba68259220d48175678bc546834b3f9524cffd
- MD5 478a63513933023c8cfa21a030e8523e
- SHA1 d9eede3f24497f7b73ec6b769eb2c5b74c579de1
- SHA512 131f7781a56d17e28c731645540dd241dd901db76ba5da0e7f079e89c9b1519f8ac67a3c930037aedbbdc45276bfed18d3469a7051e7cd3abdf2e4374485fce8
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30902510" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30902510" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b31601b1c07a947813c893dd4c3144e00000000020000000000106600000001000020000000020669ded2b4c7dc3ba7ae197a5279aa4e24d3d126a0117ae8c4122cef9ad08a000000000e80000000020000200000005a9e4472b5cd20dc4119d2781a412f28d5c07c0f383c1a5d3d0dabcb9eaa77dc20000000a495acb2eddf95c5ff364953865ab4c57ed37c5c50668a3c21e891a7046fe6f74000000045ffc2c8005e4445631d90d0931e956f0e61b0fe477d24839ec646e52ce58d91f21b514d39bfe4bbbe960df8f3ae182b7cb686af3c863ed9cef65c74ee514e91 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b31601b1c07a947813c893dd4c3144e000000000200000000001066000000010000200000001ef7bdbbcafe282f87e5edbaaac71779ba6b52dc7f938830c3ee3cf00e7e0b0f000000000e80000000020000200000002853a70c6a53de1bcfe274a3aece67cafc069d0061605454648ef055d97b89df20000000d759df2be82603d23e5f40308ace85f72fab0dfbe78ee59f71203722135b7962400000001da5a9df51cd3f8b6ac8bfc750cb3af5e9f8e4225dd5ee42d54b7208a2a34ce0dbf227fe2b60c8004e8ce845be310f6c67701f2c38004df27926476ff65de025 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a057431fee88d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "482015721" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "482015721" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{480191D9-F4E1-11EB-B2DB-76442655C859} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407d691fee88d701 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2884 2248 iexplore.exe 77 PID 2248 wrote to memory of 2884 2248 iexplore.exe 77 PID 2248 wrote to memory of 2884 2248 iexplore.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cd1d24d-c3c1-4fdb-a561-46c1e12ec210.exe"C:\Users\Admin\AppData\Local\Temp\9cd1d24d-c3c1-4fdb-a561-46c1e12ec210.exe"1⤵PID:488
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\WatchGrant.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-