Analysis
-
max time kernel
123s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 00:25
Static task
static1
URLScan task
urlscan1
Sample
https://link.eu1.storjshare.io/jvj45onounuf4bmivcq6sechdffq/44044/max.html?wrap=0#rfp@test.com.sa0-30393
Behavioral task
behavioral1
Sample
https://link.eu1.storjshare.io/jvj45onounuf4bmivcq6sechdffq/44044/max.html?wrap=0#rfp@test.com.sa0-30393
Resource
win10-en-20210920
General
-
Target
https://link.eu1.storjshare.io/jvj45onounuf4bmivcq6sechdffq/44044/max.html?wrap=0#rfp@test.com.sa0-30393
-
Sample
211015-aqk2qabbcn
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60246d315bc1d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "85000" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000005636659b79ad8ed547bd5bdae71c892ec9d2928f13478619af39b5bfb4d0c636000000000e800000000200002000000006e8d45ef1b89b7cb86298c1c9a530abfb95e252dc3926ce39338eb46c2f4af320000000cec43ccaed6940218fa57c706c6f66d37f3e45492d97f5fd3bf23ae74d962bf84000000084a941f4e9bc6734a2fd86f9f73dadd88e2fb675cb01d48e2735f2e2c41d376d08a1ef061135092f306cdf69461dd80f16bc904c83105fa411fdc92e9e605af1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7F976FC-2FA9-11EC-AF2E-DAB78683E0E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "341071070" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341022484" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "341039079" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "80000" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06f49315bc1d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d0000000002000000000010660000000100002000000026b4a7af5bdb6fe874be967b72dc23fe33a09bfa55bf5c384166acaa42c18df6000000000e80000000020000200000009f80365f87e4d337aabfb67c9b5203fc734543429ea271e5127c587530480ea920000000deebee80b4fbfa12ccea25793c19f5cf36cea024d3dffd5adc69e7bef7eee342400000003acf5cbf0d7450bec158f884ab1491d202c53be04d7f22058ee73b503a1823adaf2000f121bd7b598669f1418d212cd0d22998c6797a6709da5be5546a9c2eda iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3608 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3608 iexplore.exe 3608 iexplore.exe 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3608 wrote to memory of 4500 3608 iexplore.exe IEXPLORE.EXE PID 3608 wrote to memory of 4500 3608 iexplore.exe IEXPLORE.EXE PID 3608 wrote to memory of 4500 3608 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://link.eu1.storjshare.io/jvj45onounuf4bmivcq6sechdffq/44044/max.html?wrap=0#rfp@test.com.sa0-303931⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3608 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BSC5L7JA.cookieMD5
6c70023e450304ee704a00c44fad0263
SHA100d7fd8c84bcbfa62a781c4e0b7de93125fea3a0
SHA256a7db15d593350c780e76faf308574bd4f6f628126576db80803c293a65727892
SHA512fda324adee1910fbf87caac6777a6125b59eb4d9059833ca46ecd3974866c935eb6d972a440fb7c01bd7da700792736ebc60a08ba99ed4d8da1cf787184f2d6c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\OJ9818B0.cookieMD5
63c1488fc0103fb0d55e2b24ba9071d0
SHA162a24f0599be8f970d2c26837ab1e7dc07cb72fa
SHA256d6dfa00890c6bc9e821c910740c6b7ce1546b4a916009937ac8525992d93e1fc
SHA51250cb16ba505e31701cdf4ba1285f025ac887f98efe162bdf7e9367d2b1483f2386e7900da70ac50910211af24185d7f65d4738aa49df702d169fb89cd0e40a0b
-
memory/3608-142-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-121-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-120-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-144-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-122-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-123-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-124-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-125-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-127-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-128-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-129-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-131-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-132-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-133-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-135-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-145-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-137-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-138-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-116-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-141-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-117-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-119-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-136-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-147-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-149-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-150-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-151-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-155-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-156-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-157-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-163-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-164-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-165-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-166-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-167-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-168-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-169-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-173-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-175-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-178-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-179-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/3608-115-0x00007FFC08570000-0x00007FFC085DB000-memory.dmpFilesize
428KB
-
memory/4500-140-0x0000000000000000-mapping.dmp