Analysis
-
max time kernel
132s -
max time network
134s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-11-2021 09:13
Static task
static1
Behavioral task
behavioral1
Sample
https://hak9.conohawing.com/ruftcborglee/[email protected]
Resource
win10-en-20211014
General
-
Target
https://hak9.conohawing.com/ruftcborglee/[email protected]
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb000000000200000000001066000000010000200000007a1a5ed63a45bea339ec1cf02b9eaa0e05085eb61b322d022cf394192edd018f000000000e8000000002000020000000e02f749f10ebdf153dc980837b1eb065bb78da4b45c521c2f4b0fb9bf300d3c820000000b814b61658a5eef7655a41a33663d32778c6096ee746dbda09ba32d0998dc9b94000000001b3c3c1b47a0035b28eb2ed8f375e6821541f6ab68b8541c777fd3a404f20876139842619f30811d949438ac91848296d610c54828fd407210fe80027c546d2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "343812085" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C580747-4858-11EC-B8A2-DA737FEC8C9E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8034619d93dad701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000d03ea733e78ae2ed3c3fc2760afc7f6fb90f5f622c92026fa968479d8b846fa8000000000e8000000002000020000000da92b5ab71f91586f4443473facdfff9ccd25a6149deb1f95bf1a945827ba6e320000000660e72a8d7b28b133b6508f14f82f6bd8b47e7ef25313a393ba1dddfc605356540000000b618ca7196e2b1c11481bfef62c71bf9574338d6de2a12c6ebbb343278aae6b04db3e3f3257d1aafdd676ed97791ae32bd1d022dce0a2c4059ae0c693895e952 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343795491" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "343844077" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06b509d93dad701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3136 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3136 iexplore.exe 3136 iexplore.exe 316 IEXPLORE.EXE 316 IEXPLORE.EXE 316 IEXPLORE.EXE 316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3136 wrote to memory of 316 3136 iexplore.exe IEXPLORE.EXE PID 3136 wrote to memory of 316 3136 iexplore.exe IEXPLORE.EXE PID 3136 wrote to memory of 316 3136 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://hak9.conohawing.com/ruftcborglee/[email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3136 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_005284E085E122BD76B51F33745F7753MD5
46bb6e0f3926472382bf09407b67a135
SHA1c02ef6e1bb2e1277f41df0be0fb6053e11d05b67
SHA2569ea6cb36322d74e3adc19e710f1cde733107f4b66e8242d80e6170b27c5adc6f
SHA5120eb964995fac8404e45adf2ab6e03e4f5ebcd21c046c36e6726ef068b37b3d509226ac282db8ac351192023b3905d726848d764bf3ed88fb90394446eccd3a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD76941B08ECB69B450D4C1AE579DB94_70896B4F983D1580523FE22DA2957981MD5
602ed80970b91e164044742f5dc32eab
SHA1d99de4b789b53402f150873041ea601d29ef1beb
SHA2568993302957bb2001958ce316e86049237ed0805ee4233a44cf37b7b443ebf7d6
SHA5128d8a782682db444683438edb4d5a32a99bf480eedb769e9d069226350af7fefafb668a5affc07466c426be7aa8bff84b63f9dc57bd69ddd6a588a373a347bbf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_005284E085E122BD76B51F33745F7753MD5
bcbb301ae5fd820ebed66020f22086b5
SHA18ba6dcdd44edf31e1f8db362c4b6b0312aa6009e
SHA25659e68f1f0000e49f63f973589bd0f5f55dce30353c1d67b102bf1d9d9d57ac90
SHA51243f1af73e577c2512cc6ac619254c3883149a5548dd2360ffc825052d4a2b4cf99d3ddaf140d2226f2c278cc0c7cccbfcf1ddc9c2d05a739cbb7cd83733fc0d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DD76941B08ECB69B450D4C1AE579DB94_70896B4F983D1580523FE22DA2957981MD5
63557421f8487098b9c92e7ec91b68d4
SHA19909db1560e4b22eef7c0ad831d131a03cc8e385
SHA2565aa464645640e98a583a27d45cc30513561d41e5f0e9ec221a1c2a5b7a702157
SHA51239e0974c2df3ed5654c43cce07ba4bf1723430cf528af736f2bf7689e05b574d6e5ffbb03cca30779ac845cf51c01e1ff12f8bd9e1fdb4a60416889c8d370f11
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\I6PSEZ51.cookieMD5
62c7923d29287174dfb9d3ca85f59979
SHA1694449f2c1d90f496c9f3203e2df4834c7db7a0c
SHA2563bb03c2dbde3476e4505de9d6bdd6bac207d4c5fc7e7cb931d7f39e403175134
SHA512f44b72accdb2cb3091731a2176894f84087e47579fb62d8a5cf026089ca70e9d219ec41122d1b5272172a384f063d1c713bda059d5676d82f2bd0387e380348f
-
memory/316-140-0x0000000000000000-mapping.dmp
-
memory/3136-145-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-150-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-124-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-125-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-127-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-129-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-128-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-131-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-132-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-133-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-135-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-136-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-137-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-138-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-122-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-141-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-142-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-144-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-115-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-147-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-149-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-123-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-151-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-155-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-156-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-157-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-163-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-164-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-165-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-166-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-167-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-168-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-169-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-173-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-175-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-178-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-179-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-121-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-120-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-119-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-117-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB
-
memory/3136-116-0x00007FFB28450000-0x00007FFB284BB000-memory.dmpFilesize
428KB