Analysis
-
max time kernel
142s -
max time network
161s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-08-2021 11:18
Static task
static1
URLScan task
urlscan1
Sample
https://nawa-store.com/shopinside
Behavioral task
behavioral1
Sample
https://nawa-store.com/shopinside
Resource
win7v20210410
Behavioral task
behavioral2
Sample
https://nawa-store.com/shopinside
Resource
win11
General
-
Target
https://nawa-store.com/shopinside
-
Sample
210818-n1gz5j7lfa
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D1834A1-0015-11EC-B4DC-42CE7BDC056B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f31987340000000002000000000010660000000100002000000068461411e11baf9d0acac78beedf9fdba8e28eb11ed67b51dcc2aaf02ce15f78000000000e800000000200002000000075938a97cf7ad88c8eaf8932685ff5beb397d468d715c796e48f0c4aeefa2e55e0040000a037f6772a0faa3bf67242b0a855f31b478cbd9de208be4b4f5c1537ea054446d5fa44b089ce9463123fbd7e6876a6100ea933cd14e2fbb5bdc86428e2a3df0b825f1d1fff17230dc993dbd6f6701f61cd816dd974a79e529ab2ccc90853887c4ec3fe4fdbc14f7afd87acd86ec1c9d1ebee28fcc83e6b62e585961a6f1dda5f2ddc51bb517addd3a5c87be78cccebcab9c9cd5bf0221d9d91ff3cf523ed374b5a24afbc760e68e4092fef66cee9177dd514a2233ccec518ca1887e9689a8378bf0e62d3c46312720838c7ef35e7722fa7bdd9e70dfbc1f09c806502f078c4b2b41f54181d044dcf04cedf6cd291460999096f5be11ae4b310217852bdc3e5f6bcbd27f8889a86794578029e601bd2c551189e1fa0ea0707dce129d72e98d84ce4ff2a29b773b01169f7a4dcebbafb4130ab2bf461b0b5764f2977bde7af73064d650f8014f98f5ed2f9bf1078e602049a80a14e7d977f03a0b7568b837c6018f24f8e461867c2242471f0197323e7ee4b0cdc77d0487d422a0bbd1c4c9b1545ae1e71d86401f19dff3242cc5c4f52a097262f75c252894ca49bd33b067990b51b5128a13e2b9c9b588b80c11c7443e090a05405495b9687e3bb7adfe61afeda8e3aaf5c0f3317a4910832acda91b1e51d51e34a2322f6a54d9a63b7a60075ac3a0fdd4b15caca57c5c60fe828c1790d48f45470a621d9eb4e8d4d5f308ce683272fa2763a5e418cf2dd4634af965a692ddd9a732a8256a335b26437e181bbe2df984a66beb09795afc48956e1d9ac073db116bed3dbee4b54d5e5f28b11f56a20fb263e0dcc26ef67961614c6b2e763736f7254613c74a06356577326b2a2a702e83b8604f7ae7555c50abf8ea397377b1736a472950b1e2dffa253cd73fffd5636c0e1670be922a8e3f0eca349cc869b4e04a2377ca5fd810216472e0846a3438b054e1650428a55497c1c2cedcf164be3459213457f65e64fbd4c1f2488cd78f273f7abe350233ce2489add1cc3b8cedc46c5d265c914c1ee42bfa7fba4b7e23a10dd90ecaf8947b4194e87bae89228c3c0351dffd36e32b6072cefc8eabd3be97c11723ea1539e64df0a5a711edb2a67aec436206881bbf8306c11d5f83b08677669a7b267193142b9c564c05c9c374e067ff61f8b6ede4b27462ec5c7bb51dac839ec6ac11d1362306efb37dbf77c728607b39678daf4cbcc279b7f901aad622812dac50bbf2459f3f9e009bde1eb391f8acd4bed3d0e1b2df9a53dcbb50dd38058963c35606bf00911d8a2aa796037395dde9877e3e8c9d248a2349a4309b5cba70d56cd26690c8c7925a64de179e5022bf95d09827b5e8f4597a4095ca0d094ea6ac8cea7a266f33967d57f21af6e340b09fa1a83dd6ed43d37b402d4b6f00224106092ca2f69d91da31712ffb7cf554890fd75bd0fc523905e6f1324d0c0b42add7e2341c1fb5ef2b087a4f8e3323b2d3913ec59bcc16cd46fe34719ea3d4c0e374ed86f4fd46ffdf5b5fcddb14c9233d867b3c994087dd5424b6b96572e7704e423280efaa3fd323737b995aec367479f464f6f912cc74b1cde3e36f22975850923bba6dcac8791cff62869db5ff483eeb026af6232b9a69150dcad1f95e739bf369473a2d8b36d2a0f76b9736b739b47447c73054d86393b0e3c9bfaee40485899a70ea374bab5d73535ff509699a90b8f45b9498bf558376e33011da64de33cb9d5590e849955239d15c5ba0f93a95051e58d0fd830d24a40c0d8400000007c07a02c0794e7db1c62f7e453943b4dfc078a2bd164a9d70d31c3417efc6f09a7d22840b70ffb9f595fd6c6f802d0f7975e20dc901c604458e7fc3197e84ae4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336050312" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f319873400000000020000000000106600000001000020000000c88e319611e1d6dd7e7babb9056041c9e58880df4ddfc6a6526039b9b35c5ed1000000000e8000000002000020000000d0d975990516550f5bed8501601f58ee2403cf59b18f9fefcbcc074d11730577200000008cfe6f3e03df600b7819ef87387126f1cd42dddf01ac574e83477e5791159c5340000000c002e3a5263c6a2f9c80c97abf80939a8e5baf204d1df13243b6a2b91ba1311206348c4e82684a0b52dbb1a1f0e25cfe4a2b88eec68fa0f89f5ec66718294b64 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f3198734000000000200000000001066000000010000200000005ec1f845247f2b4527cb81e6ea390e3d3f1f9d043bf9468555c348fd03a48cd2000000000e8000000002000020000000e37fdce8d5f60409392de51d35fb5041865c83169340199627ae9a79296a27b2e004000034864511274252e4cf235d20c38c19bf15a9622759ca27c76de7b53de81500274b5a667e4d0357eff781acfa5076996f8402fdeba30a9e67f4902f0ba521d61a8696fa16700e131f240e4b606dacb9a6cd0033d3e248bf6900c7292d4a3a10e7f66f55592d9d6bfde39d594ea85c328d13ada734269f76ac90f81b3f5932bbeffd29956c01bbab7404b698da0a42ce1e4cd2d477cc4114e91371794fb1d54a878d5a946d836a2e2ac4db0501c1bc0b125af9f3d56b41970f25530c9f58560f7057000a5d19993936be0b8e8426a10fdf6713928820329456b28df1fba7fbdc0924a1625de340462aad5a6aee0c5bbd9ac380b492390b6ad124627db2145985c3beb9b841555b890b51859beb638640e3c330453e0b8e3dc41a336d91daf886bd909b9ce5a1a68af706577fe0270d6411994953dcaee40f990f68a87723e292250c64545c538fca98a4b1066ca808dedfb468ab12fe62ebd725d3e9bda2d0eafdf7b4d537bf8cbc324ea443dff6a48e2e8750986d58de42a2a509696717853fedbf9eb0e10e4d1a18582172a081be22529bd3be774f429f7108635123a3177b370c887f632867145330e2562f12e0524363a53e99e804303a78f3a4533c5544e09ca40965047b6392b6ce3836a226e05b5644b0e0e43d6119008d8738874ffae83d7902b231c83bd0370d9e928a48d9bc47c759a72c80adefc8602364e9181a347d76ff06279fe8ce6057ef13b4b9289c57f60cfb0dc4e53ebba64eb5288750ed7276c7eb03e2fe98864e80071191428d91b365bbe6d83c101eeb6bead3d9e551a47cdf58b3b413d4f8df73311b5d0cec289edec5e007e7af632e82a7b0b921e2dbef4912bbee406ffd010421c12a785a8e0367bea35a05af2f1d031f77a56c86bb6a3a2fb40bdd106d9e70d54b96a4b74f2dee11ff3a3e5632b4db4142b9f5db2c97f6e920aeb90c9be8593cba140e2a76e33982e56f820dce06f4d5457cc6cabe0689c3e2e34e81014901199ed4dafbfc353504c0953a4218070d2427152b1f9d8690516e88762100ada791878090f47e45ff15bb3acc125d0fc294f375b25d9617c0320d54e47e8f8d0adc0c74026260992398af9bc39f64a694aabd13c04b1ed08b6c1117eb05fe2d21641e95b2c519c5e46defb1c7d913af17efa7607105a70869f701d293233328367f6c7bfb178149ce5c159c297256e9aeb4092d2d084c55f5fa6e3fa6b9fa5fdc062bcdc895e2008659379e222305bdaa3212cbc10366ab7cd9b77457cc11a679344d00760180319a507bef791faee804bdf9029c98d98e06f355d36602b7312692dacf924fe9abce35a8c551dcb10cc94a58b1442a6fa1ef2aaba3f3b8b2bd35ef359bb78413250c86be72609f0a808aada5fe924d17dc74438801548d142dc83c7c2a465df0fd1b0305baaecd548ff312731c3eaa89408997c67a953fc400f9b4fc83d5e188d9005fa5fd356ab659b21a740d5970aee0f4166d35e4f41b9d351fd5b7edea64cf5d2600fed47d3dd085dce9418a31ea6865fe7401af78f30b4cd4b67ccd9354ab849e59ba15b810022ce4aa4c20f9fdfb93a966e78f79bdfda3693741a858eec80daed44a62ee36d8dc3bb54a72a40be98dddf2adf7f7866eb270936026fed3b12815d8f22864f5f1c5bf60b70655e9e19f1df7368f4000ed6e5e04ba3c9f6d48032cb97bfa4854d99120c5123b8110918bf4136340ccb70601a3c3f9b620afca182099743ffd86543c9a5e24eecb40000000b90470f6c82e909ab181dc7c7067a23b6e3a72c8ee86507909e0ed3d074e6a164a6fa4dcc7c879c43df04847e328d02ba50f9f5d18d46d5073b5e9feed6297b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d020e76a2294d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f319873400000000020000000000106600000001000020000000c39f6ee553ca6d7481c60571b7b47cfbf7e97d27998c0b1aaf2992c17032386c000000000e8000000002000020000000a13c630a9295eae78806d84959918a115c0d563fb51ad2dda8afb4870a7e0676e0040000886bf164affa60092452cacd03a0cfb10c0afdfca4d8f88dde7605aa937fdb7f0945a40381a4d7754df9666309770933de934ca801e8b9f1ca62e968e8eaf415ce1286711c4591542acc824221b192a3678f61189e20ff6a8392626ba201734f3fd67604f5eff297c0ff3c41c88934c4a2f0c2dbfea3582133c96c5bfe58ae886583a56e4c47a2f68b727deeefec02da377ff08f40bab5a4ca70780e8f0e47ad04f604d54e72c20e79db28c7a66b7777dff41d337af46fde5705450e0c152bb9eb67b1e025d1e76168ab42b138d6adea23e60bded7cb9302449c89d11ea0f4b9f4f0bfeed40a155145cf7e07c6f25afeb49211097dd5b8ac0143954f826d91ec37844f9e656e0cd0893bc25909061a78d88a84ebaf40243af5c58c85fe7af83d6e009321d4081b7c53af23dbc1de4776dcf67569820b23754abc15400d0c106bd66b056b4e49b1ceecefe0c42ecf6b2bbbe72d44690582ad66d4f8f95c4c803da6700abe4a23ec09c8eb1099a43ab1692291e66fa6784e95019ffe2cb8fc86bd9ecfde06c117807fe862b9e70defaf3234185a83c13d211a3802c1480ca5ce43bbcba814930856b305edf7b9c06764b5c3e27fa4a28404a6dfe24c845c0625b796bedfc78a2a1426600d02b88bf68774a3fce4dd0cdb38d0fb76cb2253402694de6788acc5d9ea0ff1592661be5c06ca942a25a9d15cd53009f1c352790c30fbc3f958337ffeda9b42816d0b1a07dc8836ecf926074f12230859d20bae00e5a3c01d275467bc2a9fa3db0d408fcef411b3b145623486bcd4e11da1c8c50058e7fd3e59779c7a552c8f3fccdad86960394648eebf921641e56a0c0287dedbf7bfcc730c2180b556d1ec1debbf06222c1321e903d5b570d99ce2dcd2ee2bf03f21ff81901b75ea312cfa40774a08946f036be082af0f24545be36af6ea0143dc5b19c216605b64a91a475bc6c436b2c2fbd2641ec4ec274fe6447be1c20f5979d05d92121ebdc8a5bed3a016d2151be683aed264cb7901120f1213d36d00e299209492f94bc27fcd846f07e5f99c7d3c2b9473704af4939e33f6c5e9e8c6fec2292634710f1d8a14cda00292a1c6156f692bb6d8c4b29bbcb01c70f0b9bc43a4a74a382e4408dd63780351b4fd5574ff9a5de277337231e6dfc72b8e62740d47e372c39dc1ac575ecb77ef5c1ed67e1c7cdd7d502b93365b9d44b45148f46193ed977962d1bbe6172973adbf48a6decb4c4fa1812b4f2e95eb386b6792af172277883d1260836f9ab94456371cc3aa3e2c542517710e7f897b780e055508a66fd6191e64518cd07220c8557bfe0980521632bea5e7deb196b4ebf18e50a0ea7d11cb6f694961f1a46756e53ff8779242a031a1a49209799cfea2ea06aa1700254d3a7eeeb2979a57bfd83cfd6ec47174307f61510d2adf6d31798d3d6dd510cadbc1782dd5b801403873c13b4a19665bd3be5fa0a50ee9bbd4e2febfeafe94a548b1c87f5060fdac93f0b292166bcab0571b058669d873ffd4f035a4868044de3f8f78a06f4aa2f5ba0721db6b21f97b5decb3b17ee7ee4a18a57701b2718c17577e08b62eac052d28b108c96eb7cceded763e6f62add43d7f00b59e19894d419eb3dea3d0040de6bc6b3ecedad4d6c53379b6b629654930715c9ebccc27573b8d1ac7cb44302ffd074628063fff4775343a37b8656288ae5d0261467a9debfa2b0edfeeeb078f4ce99dd64e9a31ed257410f8286d57dfffba20c0f91c4866b2c24000000007a3c87b136081f722951974ba50b859d857f6e9a77e1c3fe657c962ba45c88702e0312709a5eff18737c595053990a674ca25a6b6752bc2afd487c31d5c298e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f319873400000000020000000000106600000001000020000000e79bfdd1140df4890151fcafe3f2e547accb99728a67f9b7aee0fe961bb32225000000000e80000000020000200000004608d0d776083d51043ae407a2e9fb3331ea962c67624125fca88e052b7875cb90000000bb44fe8bcca2208be3c4ff7d7891832952c30bb5f612d8ec95240637399a579f90a40d588a0430df021b42d16a32b67a49694bc6af9ecb58ca939105401961dc7eaaab35589bb982ec04c72b7b743568d7106f4050d4a944be6360bda7af0366304b21ec91cdfcdb21f6bf027fe403b91e1d62220ac61b85ba9dfc6e1bdb67eafec0332c5d8178bd3a8cf160b079c8fc40000000903e17faded56333867f14cadea25818af6fdffb69382c8416fd953bd1292099129e29e1f83b3b3d98fde91a4f79a6dfe16e6957431a47e1c75482454a04dd69 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc9573dcdeb2b54ca39b8f38f3198734000000000200000000001066000000010000200000009f2d01a09d6e1b894d969c245fb67ea18ff5e2078523161e8264ff5ec687af2b000000000e800000000200002000000022b8ffb6ef61c2678175f37436893c757a242357d97e0d3330627e7c3c875a11e00400004f0efb72bff06e9245e4d4cd01d0c6129d3599c20414adf8bd1d53f286461c60ef964506007f63b0ecc44bda3ecab74fa943d33588945e2edd972c8fa5e7d607307578f68b68326c38078913b1d12a0e089cf831bc23b699d254e335a303ae516a733332397f1756a8536961540a77a1135aa48fd856713448cbfd17a0f9babce4ddf493eccf5ba6a3696811dc82c50fb27e11e45ec64cb4014ffc6e544c7159ce78606443caa1852dee39a1d1c5c887de1e161364e14db6bbad9034dc0b2b499fb67548a873bdb57de29957b098cfd3f7f11165ab2a23df61f655a4a607e5e6cf5ae462c89cff294a80aa877af214c898516a6c5206a3fa6db12f594f399d7a5c90ba3ea225964987b591cf31147b0d4f978121d296ea1477437ba3e1b73b05ab9414cc68e01cf02c831f93f6f1d279cf96a6e087a331c045dd0a13bd0454a5f85344cd12af7996bbba5b5a7cb0b86972d85c68eb8f7d5f13a74037e6c7fd46b3295f0e71db0a57c4d39aecaac5a9a3259bcc44a59f41fc1fa7c5d8652633b705a15464c155bdb340fe03cbc7067c8bfd69cf90ecf4776f7b35ccde4ea22f205e552a1fbc43882db630c5c694157ddf4e69ab085363985a0fc90ea5f2eab357931e48dd6300b6d383b71f197ee2d7f96d39d815949938b8ae0b44234ab6dc6edd0fdfe4b67f6498c76790493382827eb7aea48d9f3f68d56d1b433c515ed990e091d9426bdca047a974f49bae27c1058f6de07c9d42ac20e948bf691be744886e22c1f8a3f90c5bbc118486178e2e7ceb15b1942f3496298958e6e25dc4a726e2e47071806f7154c4576d4b0817308d4fa86593d8fccc5dbc5a88f18be9253357a1f5e40132538e43f57ece72444ef4167266740a15eb08a2e2e5636416ced31ae0dba43a9adb9b7781d83ae64288df95413040f6e241f12ea04fda527ec45621e6ef6e3f71072fee3c2e35ad8fdba887ce37f8ed0a9edd69561f20179225bff34bdd89ed038f338447e25fd9c108e81876550884f93489bc566729524286b72decbc72660b57f7b15a671e5fa8b4c1d05b6b16eb1fe9b1e33252ee44a661cd8bc421b7e974464cfb46774b83188436a7681834e3da34d8d6738279c07375c0b04e20a02e09289b205dc308166ddb6a48dd6b35d32c8724a51d7910c25125b1e36f36cb32de43229eaf7f5153467cd727b1e8c3583a23cfecc979e5dade9095011801067073dbdea3bccba2ed54130f3daf79040737088ade13a4d24bea5f10a751db6e4399ec1f539816b2e984262a997756611e1439006c2e100a5444d19f82a1bae6b092dc54b16f349668edcd51bdfef2bc7863d6601c2dccd6e0071fd771b88f4ded11fc63277e85e6cf188fc7aebe69323c51af8e34870f80bc80caab161e63318e5109ee4964311b7a92339349aa1d38ce97bc02a0ae76ce5f4a62deefc9e3794438168c5d33513435a1d175ed6cbd331ca585e5855c11aac0d90fdbed69fc5a6be07a2315159330e23810586f9f1b9ae74824c8a49b7c2773cc233e7144fccd1e5067f2d41392eee5a2bc317ef20bc1b43c3dcd3fff0f8c07f207658d58f08976a7cb234f28939299a42889c605d52ac8a1f3e9177f8e62eeb4d7b061b1b65e625672a32b1a96a063fed4bb98b67dfc89c10d0c411b9cbfe021647e026aff648cb5498729473420101bd723586196a853bf332508744f8137c210fdd067ee501e8684ecd5f91499af0f9d1045333ddf3e302f2c14abb56e9571424f400000003f6e1011a5a05078cb0595f4176668e57ef1d4a1cfc5781d3b575617b6057b5bc0cbbafc58a709d2f42f6c32777b772993e6fcd67cbf98861d0b9900ab9bc992 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1660 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1660 iexplore.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 1660 iexplore.exe 1660 iexplore.exe 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 436 IEXPLORE.EXE 436 IEXPLORE.EXE 436 IEXPLORE.EXE 436 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iexplore.exedescription pid process target process PID 1660 wrote to memory of 1332 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1332 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1332 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1332 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 436 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 436 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 436 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 436 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1604 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1604 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1604 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1604 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1688 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1688 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1688 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 1688 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 820 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 820 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 820 1660 iexplore.exe IEXPLORE.EXE PID 1660 wrote to memory of 820 1660 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://nawa-store.com/shopinside1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:340994 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:603143 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:209964 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:4076569 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
722d2ef73f5d127f8077f375fc2c6a0c
SHA1d38dbc2f2d9a9fac9f8ef27953e2df0ed4524c33
SHA25675ed5d20b786828ff4ea745f073bba5837219a2e6d03919e813ac476464a343c
SHA5122dd53b4284ca55d65967291500ac3c7242a4da533f59bbbb37a06e00cd27e6fa742ac70366e96169048972db42ba0fcf73a33b784baf5c312a25ada37913a786
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V13U08N9\6DE2CV80.htmMD5
ee9a86cca4b0fffd089c6ed2568ff81a
SHA15d6141fd2d802311e3eae1867973bf17c1eb4c27
SHA256eb69cbc03c576c17d12c6e42ca318e6fa092a6e1bf9805d0e556540b01863ae3
SHA5122b395e04c296093f822db29d9fee924f70b593319f0d8af0f805c91ad0063d8b1a51a3127aa607bd753cc682aaf9c5e974143abcc557006745b02b76d11b08b8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V13U08N9\O4WC40D8.htmMD5
8166bd61ec43a8d2b653e67895fda988
SHA11c4ee77e15d3b76a9ef212349701b5202670ed74
SHA2565530617be9db93b85264b158e59aece47cc2af57a1d08d7ce581cfe482571013
SHA512bfb13a1cf9cf6ba00da31242271e7ca0932a8fbc8a47106898d5314efa8883c2c963fc462b56bb2a2e67cac18ffabf65834e9d76c49964af17627eb6971b302f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZJL1OKS0\Q9A5POAL.htmMD5
02c2a6e544ddb41a688e6ac8209e1bfe
SHA1a623f4d84ce9947a93c0ac60170e37d3ed90e355
SHA2568ac8b5d28d356ea2de36b351b9f62b916540cdd60d08398e72ed8b1291ca22f8
SHA51201723293e2fded8721552fdf9504e2243deb53b585cacc505b636a4a0c9628510d82f373c31881d3b708f571aa63aa9735f31f06e088040074fe723ca0942b36
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R94UPKMA.txtMD5
5eb09ac75a5ee6764fa123410f37c248
SHA10eb04b40f46c1ede2a0f1524ff106f2f967e4ecc
SHA2566b581855e3d2aa21bf48c26aa41c51e23e346f4163446ca771984493e02dad36
SHA512adb3e32c9e7322a26bc84196326a1f3eed106bdd53af91dedc9c83bb80ab177cad0e78d39089a1d1fdd34c0e659ec785325225a6ecfce465d7922635c402a554
-
memory/436-63-0x0000000000000000-mapping.dmp
-
memory/820-72-0x0000000000000000-mapping.dmp
-
memory/1332-61-0x0000000000000000-mapping.dmp
-
memory/1332-62-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/1604-65-0x0000000000000000-mapping.dmp
-
memory/1660-60-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/1688-68-0x0000000000000000-mapping.dmp