Analysis
-
max time kernel
138s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
04-01-2022 04:28
Static task
static1
Behavioral task
behavioral1
Sample
404.htm
Resource
win7-en-20211208
General
-
Target
404.htm
-
Size
203B
-
MD5
c227967ce790fe9a246024e9734e1082
-
SHA1
a406419bb40edb2932553f7bdf88498c82adbbd7
-
SHA256
cc3aa328b29867e053ff7bf5e4d4ca84034f679ce19f5488c2d7f0d6052b214a
-
SHA512
c2842d969b00bb92b02c14120bd1266cbdab500d6515a957532282576ff4739b40ad081177310f9e7d5ad3cf3398930d247841b6706e30ab6e8659e886902883
Malware Config
Signatures
-
Kutaki Executable 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000900000001ab37-217.dat family_kutaki behavioral2/files/0x000900000001ab37-218.dat family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
nrxinrch.exepid Process 3588 nrxinrch.exe -
Drops startup file 2 IoCs
Processes:
image.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nrxinrch.exe image.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nrxinrch.exe image.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 28aae2c489ecd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
Processes:
IEXPLORE.EXEiexplore.exeimage.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206b7bb42301d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0649ab42301d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "348035529" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" image.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "348052123" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d7000000000200000000001066000000010000200000004ee2f5484093e21af802b2578f637bbef2d7e906b24c6e9aee5ddd0563f2783b000000000e80000000020000200000009422aaba7b03bb767e37bb37102c6ad0a1e152212d88705ca876b3827e0e5097200000008c4974012d839cace0c60373bd5a1139118616cd0a0c9b78a6f36ba126e636f44000000024b9ae4ee7449098c9cc517de8ecb764ad522de283fdc55cb0b0070068498a8c56a41a221c8f683481ae31abab6578511d7dbb485214a9da6094d78677206fe1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\GPU image.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "348084115" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{BA8E3F1D-7F0F-4A55-B13A-73604D99B7E5}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BC2ECAF-6F72-11EC-9231-EAE77BAD686B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d700000000020000000000106600000001000020000000d6cf32a59888e8811b29cdaf0ddebd53b49986531c3980358dbe2559cb11f9ce000000000e80000000020000200000003c7b059367a0af7222677ced4867e73b019b71dcd7c8294718e3321589024d6120000000a48af222d0cf8f75255c43c42a264c9954b92f11fc94ff7c29348c522593ec35400000000495f57d307f4b1ad20362355d0debdb2ff159dfed0f69be5f211b6fbf5c7871f13413debbdd3b926fbe09fb71cebf3042d1f1d4e3abc37607c5a268c6ddd2d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe -
Modifies registry class 1 IoCs
Processes:
iexplore.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid Process 2408 iexplore.exe 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
iexplore.exeIEXPLORE.EXEimage.exenrxinrch.exepid Process 2408 iexplore.exe 2408 iexplore.exe 580 IEXPLORE.EXE 580 IEXPLORE.EXE 580 IEXPLORE.EXE 580 IEXPLORE.EXE 3644 image.exe 3644 image.exe 3644 image.exe 3588 nrxinrch.exe 3588 nrxinrch.exe 3588 nrxinrch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
iexplore.exeimage.exedescription pid Process procid_target PID 2408 wrote to memory of 580 2408 iexplore.exe 68 PID 2408 wrote to memory of 580 2408 iexplore.exe 68 PID 2408 wrote to memory of 580 2408 iexplore.exe 68 PID 3644 wrote to memory of 1828 3644 image.exe 76 PID 3644 wrote to memory of 1828 3644 image.exe 76 PID 3644 wrote to memory of 1828 3644 image.exe 76 PID 3644 wrote to memory of 3588 3644 image.exe 78 PID 3644 wrote to memory of 3588 3644 image.exe 78 PID 3644 wrote to memory of 3588 3644 image.exe 78
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\404.htm1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:580
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\image.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Tax Payment Challan.zip\image.exe"1⤵
- Drops startup file
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:1828
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nrxinrch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nrxinrch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3588
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6VZI9KRM\Tax Payment Challan.zip.7ti31w6.partial
MD512bd7557bb598976e2b6fd37252967ba
SHA1c7240568595c37d11270ea8f3ae8d2a525987191
SHA25669e098c97202d350e9ea0268520999f0544936d28596a1a2c6fbe74b3d3b45b4
SHA51216a02481aa622828877660113ca473d762204729276441949e01cd4f579ecbafcaae0ad2d91ceb22fe571dd9f43e89df0678a98a8f0d35753f4cf60edf099f8c
-
MD5
9067728afb7344e3e7958b644b037f4e
SHA1faf0157fe97f2440126c21729e18cb1cf1f6c5bb
SHA256f18291258b4f453039dade7af3cd6741164047ded52ba76eef4e99a4f3613843
SHA51293dc1838c4535a33c60d06920bab7273fb1ee9f7f0bceb846d87b7f5fb2129cd7725de5bf3ebe7e701c6d350746fbab589864e227cbb37418ef0af436e7329da
-
MD5
ceb4610a2e6bc8ffc049d43df625c4c3
SHA1cc9f8b871c8edf18ebdc654ba64e9a90257445d8
SHA256ee4ab2d7101d0ba8f68faec3883744d8035eec005c17fc355e00e612eb424098
SHA512c0fad261493e8bb71a813c830212e06384d7b114ff4fcce1228b18b4e5823ba76423fd05800f3f1997940ae6a00b1f3d32cce08c6e2904b029f3feff5f7c9347
-
MD5
ceb4610a2e6bc8ffc049d43df625c4c3
SHA1cc9f8b871c8edf18ebdc654ba64e9a90257445d8
SHA256ee4ab2d7101d0ba8f68faec3883744d8035eec005c17fc355e00e612eb424098
SHA512c0fad261493e8bb71a813c830212e06384d7b114ff4fcce1228b18b4e5823ba76423fd05800f3f1997940ae6a00b1f3d32cce08c6e2904b029f3feff5f7c9347