Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 11:00
Static task
static1
URLScan task
urlscan1
Sample
https://mail-account-verify-d72b6.web.app/#email@email.com
Behavioral task
behavioral1
Sample
https://mail-account-verify-d72b6.web.app/#email@email.com
Resource
win10-en-20210920
General
-
Target
https://mail-account-verify-d72b6.web.app/#email@email.com
-
Sample
211026-m4e4vahca4
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000008518cd261776c04969e235c96be71f1ef5706e25ea424dd2a9572cc8e6a025c0000000000e80000000020000200000008a663e90fe47bedd9761a36777f8225dd13992a1b7f4cf621fbdd9087112d9a62000000004f814ce73567e54a4c8f76e2c482b6ce852e6d8668395a828d42a5920fabf144000000020c2215d809132dd9a51ec636bd824813f17c61c79c4b95f10e8fd0a45363b74db81fae9ce421e2f098db6d5d3a74fd31bfc43cd0fbb3ff0a989619868671de2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f056620a8fcad701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "342034313" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a050810a8fcad701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DA3381C-38A7-11EC-AF2E-C29A94B5FB66} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d0000000002000000000010660000000100002000000098be359648b6f9dd7eb7d1690278d8d30d0cff113b05eef2b74ea94c43b99ab2000000000e8000000002000020000000312b53df340faf99f823c6dcb1dda7af63c5df9d1bdd97f1de10667a4ca815f22000000048e7f69c945d33c287e8152416c5d6d8671aaac67b97a898345f9252bd79ba5b400000004bb95969a901ecd8b19d3b2ca153696df18da934c7acd07e36b5823ce55106daeb5d3e07cbf78a0cc73e93b742888a2850d15eb68e20ebdf639cc2fc3e8ea4c1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "342082899" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "342050908" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3728 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3728 iexplore.exe 3728 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3728 wrote to memory of 1272 3728 iexplore.exe IEXPLORE.EXE PID 3728 wrote to memory of 1272 3728 iexplore.exe IEXPLORE.EXE PID 3728 wrote to memory of 1272 3728 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://mail-account-verify-d72b6.web.app/#email@email.com1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3728 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\CVU75CJF.htmMD5
3555edbef590844d4cee794929cb38b1
SHA1f567b8ea1f6a1e99fd2c5d35279262c88c13b06f
SHA25604112dc9d438260c82192704530a30f67b0aa0a88b1e5513bece95a49a3cccdb
SHA5120ea1eb2b39b8dbe0ad3e7c7494119d1cdb82b7fbcd342022f3fecacc26fbd95e1ba24aa01bdb1bb202753db49eb7ee65f53d42673df11d20767d5dd155d5e45e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\FXKET3Y6.cookieMD5
a074791ff9b931f0840c07c0940467af
SHA15c1221c87ba9a9db980d03b062eed8dd5b2c12f3
SHA25601fccaa220c87d0b2a40f50e72949123164759460034fcd1c0c55cfdce20d796
SHA512fe4013d46f6bbc1cabf69b1f57680fc81cd66bffc917b83618e1acd684aa8ff7147344c17647522b8c39c12a716bfd8214fa1f415d34533afc1c60641885cda3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Y7Z47L8N.cookieMD5
496ca8d56bb3e679cbb751d70ea4b1f0
SHA167cecdc5fb5b60ef9d85d94e091df2cc39ad0c04
SHA256a5a74c8e6d053c118fbea09b2adef7c56041e1f43b2dcc5ca760db8f5521e0fb
SHA512b32a5e4178b05b3e348262c85e82919c65eb03cfe40d9253d711ba43fd722e2e235774e70a9fe8903c382e7fdae516a8ad6cc312158aef5ed6e677f3e61eadbe
-
memory/1272-140-0x0000000000000000-mapping.dmp
-
memory/3728-142-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-128-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-149-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-123-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-124-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-125-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-127-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-147-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-129-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-131-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-132-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-134-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-145-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-136-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-137-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-138-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-120-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-141-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-115-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-144-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-135-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-121-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-122-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-150-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-151-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-155-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-156-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-157-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-163-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-164-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-165-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-166-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-167-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-168-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-119-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-169-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-174-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-176-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-179-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-180-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-117-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB
-
memory/3728-116-0x00007FFF95C20000-0x00007FFF95C8B000-memory.dmpFilesize
428KB