Resubmissions
17-03-2022 11:50
220317-nzwrgadcd8 1017-03-2022 11:47
220317-nxz14sdcc9 1017-03-2022 11:43
220317-nvn6tsbfar 1017-03-2022 11:40
220317-nsw4nadcb7 117-03-2022 11:36
220317-nqrfdsbehp 1017-03-2022 11:31
220317-nmv96sbegl 1Analysis
-
max time kernel
4294179s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
17-03-2022 11:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Resource
win7-20220310-en
General
-
Target
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e50000000002000000000010660000000100002000000003114a32c6de12cc1a593da6d96c640db0702bda225fc69f9ec884d0b3e87531000000000e8000000002000020000000a9c643d156875b1daafb11fcb303907b9cf831573824a751221efada8afba0c12000000055c10b9980cf593e3bfc6f4c1e20e3826d3199e6860741f74f7581ad6cad05fb40000000b2045a055d88279571c1e4c572d465866bc75d9698ddf43f57dbb40ca88f0371f4269e0da97e0829e4589d081418aba5610088b4bc82e73caa5da43077b9fa3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "354286222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5078b840fd39d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e50000000002000000000010660000000100002000000053932e4372d111f9c8926af59f093d08644dc7fbed096e7b6f812d39a2d56b91000000000e80000000020000200000007c51dfe4eb0805d50c834007b0c8d9f2125884cd908ee00fdb5c0c5b9505b48e9000000033ce3a724af31e06979ed06ca4d032890e5f9f5900ae192056f81f33a8b44604fe0ef74649b41b1b486f1c4252debe7b1a8eded81ec1a0156acec967a6affa1a62ab0dead8ec6d91a5448e5244ce66289ab762b99d5775c180c262918e6e23ff70c4d1e420e0c83edf56cf82b65bd980ccc23a91bd6cbbf5e2944215c89e25b3fab50d91e898e74536c3e0949e3a9e384000000003ec3adcc27a7e152af3b8c04d407118dc21744a786cea13be485b66ec8b75b494c093ce3d45c9a6da9dcafc71552abb28717c79b6d752f044097dd55db4ae05 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66185ED1-A5F0-11EC-95E6-722D10E59E17} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1764 iexplore.exe 1764 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1764 wrote to memory of 2028 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2028 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2028 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2028 1764 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B241⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
cea765efc86786a2a30dc0827de4c3ab
SHA12203c7c34e00e3c50eca99c622bd821e7fd42380
SHA2561b90da13d25cb28d6d05b7adf10279492d4ab4c8c6010d051ea70574d89943bf
SHA5120f41097bc9ec6b05adc96ea9209e4dcb59aa52776da21bb4d3204171a88283a734c56ebbb553feab88d4ff68c67faaea47ef9668609d444461278dece7c843be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63MD5
88aaa1abee2d5c387f4379f46c258cd1
SHA1fb526ef7d802e57d397569bd3a5d80a7f4f30b0c
SHA256976b0f829073bf2e34d5be8c4c58b38b4788b9feb1eb813e41ab20132c419867
SHA5125b4afb14708d5b6445e305dad6890b3ae46a5f03666ae07085a597c4ce2ed9636a86a23c3abf90a7f7478a6b8da55acdf68b431d3278e42907c1225cfa934d5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
7dfa59fca85518c6e6b2747bf5c09e00
SHA1b242044d1dadc92ea2d849016375a7c157645cd8
SHA25621d8a7ea8bf7f7506a1e87dc30f07c29cec2628d22dcda29e8acfc6941fcdf0a
SHA5124bd585a3678b11b624128b72d1a31a81c3968ebce707b967a0d71e26a2d72eac22640a1da75f03e085e272ff6c1988235cf6dfe71c2a2ed944e330c78838edf4
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w8w9llr\imagestore.datMD5
03eeceecf5875d9948a55d1c12431c9d
SHA1c10401369bb6bbdaff02d359ae69303996a7831f
SHA25660025caff42df938dc89164a8884ddc3e158cfe5af93046f52c455458448229f
SHA5122928f47744723ef0348ab9d7629dda48c11bc0d54b6b2d9445a508d602223261f5a131689f14de8f8598febe590531d61464001dea6095e7f4c99d80e904b096
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AGS3ZD2N.txtMD5
02767b8fb5c3c3a9392e23c231fc4de3
SHA146ea5cf3449a398bfeb4aa33d8a5ad25c4450185
SHA25624cc064c40d0159bce4ae4fda8d2d0280e0ccb2b767cf1642aaa3e4facba6a94
SHA512f3eaddec904c1815733605d1a1adfc9238600cfec706691eec3763fae26eb4e83b6d788e905eb401bc0b6df39dddd057c4930c6420dee7850ca61d344df34c8b