Analysis
-
max time kernel
74s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-09-2021 14:17
Static task
static1
URLScan task
urlscan1
Sample
https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]
Behavioral task
behavioral1
Sample
https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]
Resource
win10v20210408
General
-
Target
https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]
-
Sample
210922-rlt79schg9
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00342d6bcdafd701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339092422" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{919A8CEE-1BC0-11EC-B2DB-46FA6997EE5A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1765474365" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbc41942358f0408e424be39f9d891100000000020000000000106600000001000020000000154bf44a3feacb103b7d390474e5c33b2bb336290cc8483d169e0a2f711a2d3a000000000e800000000200002000000081e369fe22c00ea6bbfe9c1264a7f61a9bcdb4096227d3a6ad0c1b497b9c25a720000000dc398a8f0b51478290cf24d9d97624b3070f435a366d5f6784a6b9bff14884a0400000000bcd769245416834b4032dfa02ab532ce43640e94a17a59f3a9c816e2fba6bd4643d73f8131324a16f8ffb8d51ba7f52a22b41728ac670f99822145d3eb022d3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30912461" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30912461" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6009706bcdafd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339109016" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339141008" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbc41942358f0408e424be39f9d89110000000002000000000010660000000100002000000066a8c6620e19d157cb3c4713eb3ee7c1d121bb292b7b9475eee759a72e6f881c000000000e8000000002000020000000546ff74dd0cbe7d026dcbde0c45cef72b6079fd9861e107ed1fd4716242cea50200000007b2684c1874063657292f65debda950ba023258e1bd2decd0dbbe9f18e0d166340000000e45058e852bf5de224a2743e794500935b963f8ddc5504957c85c1cc78cfb64071932c1757623f525e9ef3399d3cdd189c214600f9e81dd90880584939af6b4b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30912461" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1716568035" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1716568035" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 640 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 640 iexplore.exe 640 iexplore.exe 476 IEXPLORE.EXE 476 IEXPLORE.EXE 476 IEXPLORE.EXE 476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 640 wrote to memory of 476 640 iexplore.exe IEXPLORE.EXE PID 640 wrote to memory of 476 640 iexplore.exe IEXPLORE.EXE PID 640 wrote to memory of 476 640 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
6184b0e7016067db51a6ecf5f3fec69c
SHA1d95dc8253b3f7ee8eab391a9933de56929b7b9a8
SHA256f0310616d9b89c76451b430a7849df7d6de967e7be98d4db98b18b13fd0d4c24
SHA5121d5a39ff7c1a9896999b5a571ac198c8c7c667737f9970d1b81c49b6d20925bc800df7b5f2cc890a079646bcf8e7aba25934018e55cf555d1873f0f19dbf05c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
d665c093f04dc9d115e0f351b0ca365e
SHA16ad2ec43673a8ca72ec48bf6c79dd4ccad06a2d9
SHA256c9be1819c28f448d8a77dc8c8df7d5329a470a0e2deef710f4d84823e1fd1a13
SHA5128619d1fe5a2dbc2a06f1cff319df22cd4e51922682fa9f8473cc301d0aa104ff730bd2b76b1b148d58c6d404c3327401adc2536116f38c607e1755503ea57a3f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\O8H5FI86.cookieMD5
a6552a10aa849273afc644cc042f00ca
SHA1023f03501f4bd14bfa91950f5bdd188726627290
SHA2562bd81be20ac4dcaa0762049289a7b31fa4b5b7c61af46009937101d6b97de072
SHA5125ed6e4c7149286507b81f41fd4733d328c8ad0fd9ee07b950e7feec0bfca73362585888aad36c960a0ebe79a57835be0d09eaba4698d73301a35c93ed95d9b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\T7CTSXI1.cookieMD5
e64e01d5269e2b4b60f19c6492007f50
SHA1b306ec66243d6f5f20b699b63f359533e35d3fdc
SHA256698467355d7cfd141a7578ad29310a505c162fb999690cf74295ee76792d88f3
SHA512861280ee1fcf5a00b375337efa3765fb4e3b4fb78cf7c9c962e485f7a5a7f88ee8dc991f3027111bb6d0e804f6a57a9c14319efdc249e11649988623a91cbfff
-
memory/476-115-0x0000000000000000-mapping.dmp
-
memory/640-114-0x00007FFDD6DA0000-0x00007FFDD6E0B000-memory.dmpFilesize
428KB