Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 13:53
Static task
static1
URLScan task
urlscan1
Sample
http://www.authupdas.site.pro/
Behavioral task
behavioral1
Sample
http://www.authupdas.site.pro/
Resource
win10-en-20211014
General
-
Target
http://www.authupdas.site.pro/
-
Sample
211021-q7d8haadd4
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "341638003" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01aa33083c6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{979CEB19-34E2-11EC-B8A2-E6DE94465761} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000a14e4c8cb879921e25b637b7d4a8e842686612d94c981942b4c8488ff5cc620a000000000e8000000002000020000000ae08df04e94b39ecff2e70160e47fbaf2945142002b51d5cbdb6da914e5a2c842000000093abbf749ab04a13f1ab2114fb6eb941cd23ee061ae2fbb6d24ac9cec86f64fd400000007f2817da01b83c7002608faa481608df0612055cd862e6efb57d5fb0836f094d0b8ea56a404504dd4a6602762f555995a49fc8ed64914e41fa974cfce7d029b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341589417" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "341606013" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509d6e3083c6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb000000000200000000001066000000010000200000002f2ada6eaaf7f7f9b4927aa42f350becc159d0bb159e4eb996718f6dde24050c000000000e8000000002000020000000e28831aeaffcd18d8c80be8f25e09448fbbfa0175eb7bc4ba5c83657079f6765200000004cb7f1b7ca4860b9701bb94bb1e8d3406deba1e8864332f69d2d97a543ad28ea400000007496c1b4c74f3a2bcbd926d97c6a3e06db6dd506d366025f2cacaf260ad000cf8dc1890765035e1eca555e0b9ceb29a0ff0c34f3291a559268b4ff23691e5f25 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2728 iexplore.exe 2728 iexplore.exe 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2728 wrote to memory of 1312 2728 iexplore.exe IEXPLORE.EXE PID 2728 wrote to memory of 1312 2728 iexplore.exe IEXPLORE.EXE PID 2728 wrote to memory of 1312 2728 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.authupdas.site.pro/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\E21MY8GY.cookieMD5
491d06b2c2cb1b556e942f32b8bc973b
SHA1038c993590f81c15e8dfa23ffc54c8dc128e92ea
SHA256d415a91e21af65a575a7e51466320a6e660de88b3fd337da3650b3cf0b6454ac
SHA5125476119690fd842e44a81e45a606ef87240fca03d6de67deef47d78f26e303e3112441bea275d1ebe20e7c4e0721eaff2eeb61e0c01e166b35b1eec26827dae6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\F5FGQLA7.cookieMD5
f4ea18d417ae582add7b96be249d3840
SHA1c176d7fbe38ab3528d396019fe5b1070ed4f8cec
SHA25605721aa4e51571307b5b1422986f3d99b37b207d936de0e371abe7e200c0bdf8
SHA512eac321da0854db101ac6633aa07de726a701c1052fee6b2ecaae124d9bd72caa84aba0defc1cf936b0d1c3755d67848afd029b0fbf14d4b2c8277f090f1ec9cb
-
memory/1312-140-0x0000000000000000-mapping.dmp
-
memory/2728-142-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-127-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-147-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-122-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-123-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-124-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-125-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-145-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-128-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-129-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-131-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-132-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-144-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-134-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-136-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-137-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-138-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-119-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-141-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-115-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-133-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-120-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-121-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-149-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-150-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-151-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-155-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-156-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-157-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-163-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-164-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-165-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-166-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-167-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-168-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-169-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-173-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-175-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-178-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-179-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-117-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB
-
memory/2728-116-0x00007FF849CF0000-0x00007FF849D5B000-memory.dmpFilesize
428KB