Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-01-2022 04:28
Static task
static1
Behavioral task
behavioral1
Sample
404.htm
Resource
win7-en-20211208
General
-
Target
404.htm
-
Size
203B
-
MD5
c227967ce790fe9a246024e9734e1082
-
SHA1
a406419bb40edb2932553f7bdf88498c82adbbd7
-
SHA256
cc3aa328b29867e053ff7bf5e4d4ca84034f679ce19f5488c2d7f0d6052b214a
-
SHA512
c2842d969b00bb92b02c14120bd1266cbdab500d6515a957532282576ff4739b40ad081177310f9e7d5ad3cf3398930d247841b6706e30ab6e8659e886902883
Malware Config
Signatures
-
Kutaki Executable 3 IoCs
Processes:
resource yara_rule behavioral1/files/0x0006000000014053-63.dat family_kutaki behavioral1/files/0x0006000000014053-65.dat family_kutaki behavioral1/files/0x0006000000014053-62.dat family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
lyymfach.exepid Process 1640 lyymfach.exe -
Drops startup file 2 IoCs
Processes:
image.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lyymfach.exe image.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lyymfach.exe image.exe -
Loads dropped DLL 2 IoCs
Processes:
image.exepid Process 1564 image.exe 1564 image.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 00e410a82301d801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "348035525" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC202121-6D16-11EC-AF3B-7EB9569AE3EA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000f5eb99f357bc5ddbb9b7b2fbfd602c7e4ea49fcd240f579a377b4b57fe6aeed9000000000e8000000002000020000000ccde27cfe33b59b1ce82c8e2e53cf83e95f9f07d8915a43b109f306f918ca763200000008c6f7b1904a9b9b6d5503c9ac386d2a114ef68721edbd5a1078c7f727e6072c84000000054b64c98d76a468576bc020e65106659ba5faee8303cc4755c8ec0dbbb86ecdda31da5eb812e0398febf451885b8895737322bbf6616ea1b0a4496c84b1aa29c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403852b42301d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000007265b0b7ab54cf878e979c1d8ffb20c0a53d204b088b27220c42fe193293ae9c000000000e8000000002000020000000a7d84730718d4471dc02eed6b8bfe43f79b5622d6bf5bc060e1a2bed526fb07190000000f254f9b336cb0bf4bf52acc7925d7c88fecf807a3b16ed2b8c51b70a65e98878091b31e09d53cbc4780c0928b86595fd8dcf3eae73ad50166982d68d19b18b57a471be4b0ad1725a9f2c67676bdfa82d9abb06ff573e995b5909c477a13f66b974613826e14750ba6117b39220f129ff332ed78a727204f6ec6a6a41a36b298002a16611475d44885881315d1e190a7f4000000043235572f0272d9c70e5e971a9745375f0aaf4f9ecbc1388b2688ae41bca2c8442fd61ac63b1218cc8e75204284a6b9a164daf60717f074f8b4a6dc09c371f1d iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid Process 600 iexplore.exe 600 iexplore.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
iexplore.exeIEXPLORE.EXEimage.exelyymfach.exepid Process 600 iexplore.exe 600 iexplore.exe 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1564 image.exe 1564 image.exe 1564 image.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe 1640 lyymfach.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
iexplore.exeimage.exedescription pid Process procid_target PID 600 wrote to memory of 1092 600 iexplore.exe 28 PID 600 wrote to memory of 1092 600 iexplore.exe 28 PID 600 wrote to memory of 1092 600 iexplore.exe 28 PID 600 wrote to memory of 1092 600 iexplore.exe 28 PID 1564 wrote to memory of 564 1564 image.exe 35 PID 1564 wrote to memory of 564 1564 image.exe 35 PID 1564 wrote to memory of 564 1564 image.exe 35 PID 1564 wrote to memory of 564 1564 image.exe 35 PID 1564 wrote to memory of 1640 1564 image.exe 37 PID 1564 wrote to memory of 1640 1564 image.exe 37 PID 1564 wrote to memory of 1640 1564 image.exe 37 PID 1564 wrote to memory of 1640 1564 image.exe 37
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\404.htm1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:600 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\image.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\image.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:564
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lyymfach.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lyymfach.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\Tax Payment Challan.zip.eyabtkq.partial
MD512bd7557bb598976e2b6fd37252967ba
SHA1c7240568595c37d11270ea8f3ae8d2a525987191
SHA25669e098c97202d350e9ea0268520999f0544936d28596a1a2c6fbe74b3d3b45b4
SHA51216a02481aa622828877660113ca473d762204729276441949e01cd4f579ecbafcaae0ad2d91ceb22fe571dd9f43e89df0678a98a8f0d35753f4cf60edf099f8c
-
MD5
05b2d35d2f23656193e698ad9cf4f043
SHA1cf781a12e9c6fda8a638f568b1a8650c711c5643
SHA256d3969411bb43a232dae2af2a8c1e494d0b97e9a1f03684144802031da5e6d91d
SHA512f5088a63325c2e649f31c8d46e7523c71be7db38b6fcf5831aa93fed206b8c5802b6a200c0857cc2d7e4a9b98dfe88c4f832c3ce3098baea4f832a7427de3ddd
-
MD5
ceb4610a2e6bc8ffc049d43df625c4c3
SHA1cc9f8b871c8edf18ebdc654ba64e9a90257445d8
SHA256ee4ab2d7101d0ba8f68faec3883744d8035eec005c17fc355e00e612eb424098
SHA512c0fad261493e8bb71a813c830212e06384d7b114ff4fcce1228b18b4e5823ba76423fd05800f3f1997940ae6a00b1f3d32cce08c6e2904b029f3feff5f7c9347
-
MD5
ceb4610a2e6bc8ffc049d43df625c4c3
SHA1cc9f8b871c8edf18ebdc654ba64e9a90257445d8
SHA256ee4ab2d7101d0ba8f68faec3883744d8035eec005c17fc355e00e612eb424098
SHA512c0fad261493e8bb71a813c830212e06384d7b114ff4fcce1228b18b4e5823ba76423fd05800f3f1997940ae6a00b1f3d32cce08c6e2904b029f3feff5f7c9347
-
MD5
ceb4610a2e6bc8ffc049d43df625c4c3
SHA1cc9f8b871c8edf18ebdc654ba64e9a90257445d8
SHA256ee4ab2d7101d0ba8f68faec3883744d8035eec005c17fc355e00e612eb424098
SHA512c0fad261493e8bb71a813c830212e06384d7b114ff4fcce1228b18b4e5823ba76423fd05800f3f1997940ae6a00b1f3d32cce08c6e2904b029f3feff5f7c9347