a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679

Analysis

max time kernel
155s
max time network
156s
platform
windows7_x64
resource
win7-en-20211014
submitted
17-11-2021 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HorionInjector.exe
Size

427KB
MD5

fb3652cc3a387c107714440829ac7264
SHA1

bf1275265b68ac09b54de10be9e0c1f2b48a352e
SHA256

dd22919a17110bb3d20ede3be4c029af8626d1459f50b2b5534ae2a77cc8c39b
SHA512

c5a0082b19e2a0c22b75b3ddf1e487ba6b002f0e7455e3fae2442a02c6e2844f2703d3428fcd63b26bb4edca442ab776ec7ad2856c816ba7610c81fd160b4cc7

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 4034fe67dadbd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343935878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F913921-47CD-11EC-9720-CAFA8C60A563} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

HorionInjector.exe

description pid process

Token: SeDebugPrivilege 1596 HorionInjector.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

368 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

368 iexplore.exe
368 iexplore.exe
1004 IEXPLORE.EXE
1004 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	1596	HorionInjector.exe

pid	process
368	iexplore.exe

pid	process
368	iexplore.exe
368	iexplore.exe
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

HorionInjector.exeiexplore.exe

description	pid	process	target process
PID 1596 wrote to memory of 368	1596	HorionInjector.exe	iexplore.exe
PID 1596 wrote to memory of 368	1596	HorionInjector.exe	iexplore.exe
PID 1596 wrote to memory of 368	1596	HorionInjector.exe	iexplore.exe
PID 368 wrote to memory of 1004	368	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 1004	368	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 1004	368	iexplore.exe	IEXPLORE.EXE
PID 368 wrote to memory of 1004	368	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/vs/16/release/vc_redist.x64.exe
2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:368 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a74c7478f74da2a091c4c97e30176530

SHA1
5d07dc928f218c71dd5f9b829616d1d8b92e19b5

SHA256
994a90c245f94acd5a7c2ba353a5cce836cc82668ba5d891670b3f6d3c23bbea

SHA512
9e9cb4833bd1143583f0a1d53862acd8cfebe697bb041156022149f7509974ef77ed04ddb3cfe47ccfdfed293dc0ab2eb42acda03c37dd38b54ff55f3f9bd7a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OTVOI5J6.txt
MD5
4916f9e274f403f65b59eaa355bfc8e2

SHA1
09d195584d60d724cabe210e6c05fa106f57d8b4

SHA256
18c8055546be7ad5808a48900d8d48cdea343414c2ef84bf2c8ae1f91e89515a

SHA512
f59893c3d1ac931e03f9a504f76b2420e3c4216837c0cd8bbafe630c02437967e7b79cf062c24d45d677cc041dbe13abc7db08a4445357332bdc5f9f5117599f

Download Submit
memory/368-62-0x0000000000000000-mapping.dmp

Download
memory/368-64-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1004-63-0x0000000000000000-mapping.dmp

Download
memory/1596-55-0x000000013F670000-0x000000013F671000-memory.dmp

Filesize
4KB

Download
memory/1596-57-0x000000001ACA0000-0x000000001ACA1000-memory.dmp

Filesize
4KB

Download
memory/1596-59-0x000000001C9F0000-0x000000001C9F2000-memory.dmp

Filesize
8KB

Download
memory/1596-60-0x000000001C9F6000-0x000000001CA15000-memory.dmp

Filesize
124KB

Download
memory/1596-61-0x000000001AD20000-0x000000001AD21000-memory.dmp

Filesize
4KB

Download