Analysis
-
max time kernel
143s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 21:39
Static task
static1
Behavioral task
behavioral1
Sample
srv.html
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
srv.html
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
srv.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b2a5d57d23d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F9490B4E-8F70-11EC-B9A4-E2544E0102A4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30942077" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2079b2d47d23d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000007f57dd83e1bc8562055326221e74375f0b0a6760f1c1e9f71239f06f6b9d327f000000000e80000000020000200000007c059dde4fbba5fef1f91cbc2f9388e5c4927b8545507f5fdb57f7cf5568440a20000000ba6a343042f7c2535a95ba14add87c638adfe14318cb50f781b7faee7f00a440400000008cfe6b7bd113658b7b984c0aca6e0fafd2200cbee1b75a7ca52a59d9b9e40ca6c8cd6b0ed93aefe77f043281d14ec5789ed4957975a95e19dfd712acc98fe201 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3455816623" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30942077" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3543628934" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30942077" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351812590" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3455816623" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000597a6c186ab7f5e3c343b10a9e43f23ceae6e69df5849847b876121f0d1a4c4e000000000e8000000002000020000000f65ed68055de0aa7610fc4d93b16b14a898327af13d20874a29364da277f36cb200000001f8eff9fa5bbab53b83fa83c785ebf6637a523d4a941deb844c99bfd3e1b19b240000000181316fc2e26a4dd9d9d1cecc915471290208a47198a79096182c09d0eee9ca074febe0a7c5ad5edc450bed89962eb26f03112646925e7d2f33e6e9d9a322547 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1776 svchost.exe Token: SeCreatePagefilePrivilege 1776 svchost.exe Token: SeShutdownPrivilege 1776 svchost.exe Token: SeCreatePagefilePrivilege 1776 svchost.exe Token: SeShutdownPrivilege 1776 svchost.exe Token: SeCreatePagefilePrivilege 1776 svchost.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe Token: SeRestorePrivilege 3932 TiWorker.exe Token: SeSecurityPrivilege 3932 TiWorker.exe Token: SeBackupPrivilege 3932 TiWorker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1280 iexplore.exe 1280 iexplore.exe 4588 IEXPLORE.EXE 4588 IEXPLORE.EXE 4588 IEXPLORE.EXE 4588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1280 wrote to memory of 4588 1280 iexplore.exe 81 PID 1280 wrote to memory of 4588 1280 iexplore.exe 81 PID 1280 wrote to memory of 4588 1280 iexplore.exe 81
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\srv.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3932