Analysis
-
max time kernel
152s -
max time network
188s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-09-2021 14:08
Static task
static1
Behavioral task
behavioral1
Sample
1ZA109T4043832978.html
Resource
win7v20210408
General
-
Target
1ZA109T4043832978.html
-
Size
964KB
-
MD5
110d30a1d7b3e9db16ee8a1b26809973
-
SHA1
3ce7f7238d5be83f9271d81d3d4e39427b232de4
-
SHA256
9755c765d48923802c2e5824522c2e25a0bfaece419061d6e223e7f74a067d18
-
SHA512
d90ac13381a6c5e8c8a5e1b66dc63e1ec9f90ba2715d82ac3fe8651d59a88b9d142c63d8dd16274f449fd6f6b396fa976ec4470c1d4dd3f773c14bc9a2a2b869
Malware Config
Extracted
xloader
2.5
tr7h
http://www.globalinterchangellc.com/tr7h/
hnhstudios.com
du-lang.com
lonestartradeoilllc.com
criptool.online
rebus-automotive.com
boxedwallconsepts.net
helixarray.com
jinqiaodianfen.com
goldenwaxi.com
comprarloterianacional.com
digebitdigital.com
cryptoupp.com
332151.com
bousui.club
redakassoumeh.com
giantinosglobalreachstore.com
resultsnft.com
papicolar.com
juvesti.com
tax-kaikei.com
fondosanimados.com
iamdrina.com
thenerdversity.com
dbdembroidery.com
credreality.com
brandinghollywood.com
texasshydraulics.com
empresafabago.com
oscyrk.com
greenworlder-game.com
smarti.space
cablerailingdesign.com
miura-conseil.biz
investoroffence.com
economicfreedomtools.com
xn--espaol101-o6a.online
tamoca.com
vezmnmnr.xyz
muniaduttafoundation.com
penshowmaps.com
thelettingagent.online
nfractal.digital
5151vip36.com
artelaser.net
001yu.xyz
xn--grlitzerseebhne-8sb7i.com
starlamovement.com
minacezsa.xyz
dizajnbalkona.store
edenhomeinspections.com
knx-concept.info
mccorveywedding.com
efterpisart.com
superbitems.com
beandhira.com
dawang999.com
kentvebaskanodulleri.com
range4tis.com
clark-painting.com
associatedmove.com
whwzhsw.com
yiganyimiao.com
pingwangjinrong.com
drivingflex.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1268-72-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1268-73-0x000000000041D4C0-mapping.dmp xloader behavioral1/memory/1560-80-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1ZA109T4043832978.exe1ZA109T4043832978.exesystray.exedescription pid process target process PID 1912 set thread context of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1268 set thread context of 1220 1268 1ZA109T4043832978.exe Explorer.EXE PID 1560 set thread context of 1220 1560 systray.exe Explorer.EXE -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 70d4ed5b4cb5d701 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000771ee55a997458458854c3c1d0f296e20000000002000000000010660000000100002000000013f8df596a0354b5e9aac37ea0a49debd8b477b2c8e93f909c11956792f8c612000000000e8000000002000020000000d5ea9ff8cdc0087f12a66e1111b4c581416206396a446a749d0000ac12d3b0db20000000af65e22024e1184fc5c8e9c46b7ec4fb2b404a4ed970f696b707b5b3d050c16440000000d769cec6457425639f8d7d3761422146c7d13aecee9cd19f4ea7b64849618f4a9bc9bd5679c4b4ee7ef8d7749788b8325045cf59f712d01113df49c9a2868821 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d6ad6d4cb5d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000771ee55a997458458854c3c1d0f296e200000000020000000000106600000001000020000000d38a85d81f5deefabcb81046be8f884cba45ea2a126f64ec01bfefcf5cb6fed4000000000e80000000020000200000007287f150bdfd0b520126c1c57dd8adfb2c534b17ca588021676d258bea08890d90000000948e379a264fb158296ddd07478b9e25702724795fdb30750946e64e8eb47101cbeccea3a1d8eb0ffaa05590cb9e571ca70564fe9150efaced736e3035b6bb9e5bb147a06ac527fb95254e229ad126faac57d154f27a4f694771dd73b559e9c1e98481db5e2c0b9c7b3165f04323fe9540a05fd957132b5d08d2fd337dcf5e68f39d7f890002354dba9f2cf15ccba2d240000000d3a503b9b3379435a5aff6389fcd324e040911cece27172904080a9bc92b5e63feead5501da386fb1da5819362016e2466f21114ab06a965b15d09eaf2471eef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339696732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9678B4C1-213F-11EC-9091-EA64D349DA9B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1ZA109T4043832978.exesystray.exepid process 1268 1ZA109T4043832978.exe 1268 1ZA109T4043832978.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe 1560 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
1ZA109T4043832978.exesystray.exepid process 1268 1ZA109T4043832978.exe 1268 1ZA109T4043832978.exe 1268 1ZA109T4043832978.exe 1560 systray.exe 1560 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1ZA109T4043832978.exesystray.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1268 1ZA109T4043832978.exe Token: SeDebugPrivilege 1560 systray.exe Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1708 iexplore.exe 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1708 iexplore.exe 1708 iexplore.exe 1176 IEXPLORE.EXE 1176 IEXPLORE.EXE 1176 IEXPLORE.EXE 1176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
iexplore.exe1ZA109T4043832978.exeExplorer.EXEsystray.exedescription pid process target process PID 1708 wrote to memory of 1176 1708 iexplore.exe IEXPLORE.EXE PID 1708 wrote to memory of 1176 1708 iexplore.exe IEXPLORE.EXE PID 1708 wrote to memory of 1176 1708 iexplore.exe IEXPLORE.EXE PID 1708 wrote to memory of 1176 1708 iexplore.exe IEXPLORE.EXE PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1912 wrote to memory of 1268 1912 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1220 wrote to memory of 1560 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1560 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1560 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1560 1220 Explorer.EXE systray.exe PID 1560 wrote to memory of 1416 1560 systray.exe cmd.exe PID 1560 wrote to memory of 1416 1560 systray.exe cmd.exe PID 1560 wrote to memory of 1416 1560 systray.exe cmd.exe PID 1560 wrote to memory of 1416 1560 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.html2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_1ZA109T4043832978.zip\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_1ZA109T4043832978.zip\1ZA109T4043832978.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Temp1_1ZA109T4043832978.zip\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_1ZA109T4043832978.zip\1ZA109T4043832978.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Temp1_1ZA109T4043832978.zip\1ZA109T4043832978.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D4X32ZLU\1ZA109T4043832978.zip.f4gd60f.partialMD5
00752f351a7e9b505c1a447c0622bc8b
SHA1c50446059e63de394c6c79799ab08c8a577e95d8
SHA2568156deadf31feb5a8d2b0de8168c6ea2d07d1d3e5d48e90e425c08417b020a7c
SHA512c3f42a01f2d7d27835d8a524b31249649722837f5e2e9c60384559c439e8b04110e92da26a164d6090de329714178bc85812cd0c3c37f274cbeda40f286eea3d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\86ILDFOX.txtMD5
bab124e1fb00d6209c284e36239df7a7
SHA1f4de2b83eeeb2eb84b4154a1c1ee9a50f7443b7a
SHA2568fd608a01c47f3405d908b08374ad5e1ef3eb422a876f9e75ba94de245e29313
SHA512caf10476a547353e9ebe932d6daa766e72f130114afa318ae9456d90227f8cac80128c15c35bec44ec3a7d4d6914011ab40eb5e97848eb8ddacd083e0df7c0d6
-
memory/1176-61-0x0000000000000000-mapping.dmp
-
memory/1220-76-0x0000000007AC0000-0x0000000008E16000-memory.dmpFilesize
19.3MB
-
memory/1220-83-0x0000000007AC0000-0x0000000008E16000-memory.dmpFilesize
19.3MB
-
memory/1268-73-0x000000000041D4C0-mapping.dmp
-
memory/1268-72-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1268-75-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/1268-74-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1416-81-0x0000000000000000-mapping.dmp
-
memory/1560-82-0x0000000000940000-0x00000000009D0000-memory.dmpFilesize
576KB
-
memory/1560-80-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1560-79-0x00000000009D0000-0x0000000000CD3000-memory.dmpFilesize
3.0MB
-
memory/1560-78-0x0000000000E20000-0x0000000000E25000-memory.dmpFilesize
20KB
-
memory/1560-77-0x0000000000000000-mapping.dmp
-
memory/1708-60-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmpFilesize
8KB
-
memory/1708-62-0x0000000003A10000-0x0000000003A11000-memory.dmpFilesize
4KB
-
memory/1912-66-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/1912-71-0x0000000000BB0000-0x0000000000BE8000-memory.dmpFilesize
224KB
-
memory/1912-70-0x0000000000670000-0x0000000000672000-memory.dmpFilesize
8KB
-
memory/1912-69-0x0000000004A00000-0x0000000004A68000-memory.dmpFilesize
416KB
-
memory/1912-67-0x00000000002C0000-0x00000000002D3000-memory.dmpFilesize
76KB
-
memory/1912-64-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB