Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 20:42
Static task
static1
URLScan task
urlscan1
Sample
https://forms.office.com/r/aBEBzrRgFD
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\office.com\Total = "56" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\office.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30917349" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30917349" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "341240635" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\forms.office.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4164927138" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23453AA1-2ED9-11EC-B8A2-5ABF81630FAC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\office.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb000000000200000000001066000000010000200000005e5b1a7d0db59c5a217039ea755fc4a6640a74ff931180c086a3c2db4b39873d000000000e8000000002000020000000c04a3b3c4c392b608f6a5af1ec9684ac0696be6c5c2472044aeac497963bdf1220000000c33852902deaf2add8e4bf551a5724b249e930348f7327db04a436d3c3581a4c4000000015826ea04c56fb9dfb7773dee7b5e2cad3d5d2fd79e2075e3286840c6e97a3addeafe4ad950c83210df396a3639d3ce2a3140a04ad2ff3be37b9913aaa0f52a5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4227427019" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30917349" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\office.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "341208644" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\forms.office.com\ = "56" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\forms.office.com\ = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4164927138" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e613eee5c2d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "56" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341192049" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe -
Modifies registry class 1 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4092 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4092 iexplore.exe 4092 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4092 wrote to memory of 2216 4092 iexplore.exe IEXPLORE.EXE PID 4092 wrote to memory of 2216 4092 iexplore.exe IEXPLORE.EXE PID 4092 wrote to memory of 2216 4092 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://forms.office.com/r/aBEBzrRgFD1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
a8835db529d0dafeba4be63477251216
SHA10699c7513959c1337ef4f8e606d4a4238dfffd12
SHA256289077378a90459a199f40f7610e4ec15d7f11a2f6a5528c0e6f094afb5200a5
SHA51247b805e0994d85b66202dab0d60045786eee485897cb483f750454ef3d81ce68515511dddc8a13e4d80776328687279eef14d966d77856c27ee2fdedafe074c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
6b2d44ee64c71e3abf13886e4b4b2991
SHA14a512f5818acefc2ed0f7cae010d56e519e718f9
SHA256f88aeefaf78be3cb4819c07dc40a8aeb733c07bebadb8f195f7162ae7e69e396
SHA5123651cbd59f59eed4a62ab7f26b2695ce153550a19f15e3c9a1fe0074f643388f4aba6dfeef7b310ce008f5c527a1df1920d7f652d4089247fe3610c88100d00f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\K6HTK135.cookieMD5
9a92447db16af97315f815a71944fd6b
SHA13e6f2b37da15e746b0dcf9f80daa7389ce65e1ab
SHA25676641ac1ddbf28b390f02a518aa93bb4b00da91301beebd8cb2dff8db2c2f858
SHA512a2d9dd453831030d47836f7b4aa2d1f8268296009aee856f3751369624148bfb799efa81a33ff489665689dafd279595ec20532ef713139e8260705d2640431d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PX7PV7CT.cookieMD5
6936cc561f62119dca63fc58c427e3cb
SHA17f475fda7f1d706419eeb8329ed8d83d44a0f52f
SHA25646b6a86d0b60dd319c0a2d113df6c72d9b4e57fdfd4d9e0d4b93d667918466ca
SHA512dfe959e5f098e15fbf06541f4b86de08812a167ed049484eec954461d1198a63a59f3c1bda21b2ebb25c361ec3208a2f4b6eccc1163564b278cace2e84778b04
-
memory/2216-140-0x0000000000000000-mapping.dmp
-
memory/4092-145-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-124-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-123-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-149-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-125-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-127-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-128-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-129-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-131-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-132-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-133-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-135-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-136-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-137-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-138-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-150-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-141-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-142-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-144-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-115-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-117-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-122-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-121-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-151-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-155-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-156-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-157-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-163-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-164-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-165-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-166-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-167-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-168-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-169-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-170-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-171-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-174-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-175-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-176-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-120-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-119-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-147-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB
-
memory/4092-116-0x00007FF915A40000-0x00007FF915AAB000-memory.dmpFilesize
428KB