Overview
overview
3Static
static
3Onedrives/...AO.htm
windows7_x64
1Onedrives/...AO.htm
windows10-2004_x64
1Onedrives/...GC.htm
windows7_x64
1Onedrives/...GC.htm
windows10-2004_x64
1Onedrives/...O.html
windows7_x64
1Onedrives/...O.html
windows10-2004_x64
1Onedrives/...P.html
windows7_x64
1Onedrives/...P.html
windows10-2004_x64
1Onedrives/...LO.htm
windows7_x64
1Onedrives/...LO.htm
windows10-2004_x64
1Onedrives/...FE.htm
windows7_x64
1Onedrives/...FE.htm
windows10-2004_x64
1Onedrives/...TR.htm
windows7_x64
1Onedrives/...TR.htm
windows10-2004_x64
1Onedrives/...an.pdf
windows7_x64
1Onedrives/...an.pdf
windows10-2004_x64
1Onedrives/...A.html
windows7_x64
1Onedrives/...A.html
windows10-2004_x64
1Onedrives/...bg.png
windows7_x64
3Onedrives/...bg.png
windows10-2004_x64
3Onedrives/...F1.png
windows7_x64
3Onedrives/...F1.png
windows10-2004_x64
3Onedrives/...ion.js
windows7_x64
1Onedrives/...ion.js
windows10-2004_x64
1Analysis
-
max time kernel
169s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-05-2022 22:31
Behavioral task
behavioral1
Sample
Onedrives/Onedrive1/AO.htm
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Onedrives/Onedrive1/AO.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Onedrives/Onedrive1/GC.htm
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Onedrives/Onedrive1/GC.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Onedrives/Onedrive1/GNO.html
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Onedrives/Onedrive1/GNO.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Onedrives/Onedrive1/GP.html
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
Onedrives/Onedrive1/GP.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
Onedrives/Onedrive1/LO.htm
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
Onedrives/Onedrive1/LO.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
Onedrives/Onedrive1/OFE.htm
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
Onedrives/Onedrive1/OFE.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
Onedrives/Onedrive1/OTR.htm
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
Onedrives/Onedrive1/OTR.htm
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
Onedrives/Onedrive1/Starting-Business-plan.pdf
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
Onedrives/Onedrive1/Starting-Business-plan.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
Onedrives/Onedrive1/YA.html
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
Onedrives/Onedrive1/YA.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
Onedrives/Onedrive1/images/landing-devices-bg.png
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
Onedrives/Onedrive1/images/landing-devices-bg.png
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
Onedrives/Onedrive1/ojomu/OF1.png
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
Onedrives/Onedrive1/ojomu/OF1.png
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
Onedrives/Onedrive1/verification.js
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
Onedrives/Onedrive1/verification.js
Resource
win10v2004-20220414-en
General
-
Target
Onedrives/Onedrive1/OFE.htm
-
Size
1KB
-
MD5
6911992ff4ff9a120ef3a5b47665bc43
-
SHA1
00529af6376d7909e3cca30b83310e932c746301
-
SHA256
71626f486da8284aa5873c98bf92fe33aa567d77a1c2e2976a57e39648605221
-
SHA512
7d1e3fa1cf285e03dfb4ab03f3084f5afdb66d663aeb20d8fe29e90c125f6925723bf0bbf5a91e0c18e207c4a36070c0b6e423c78c57a91fa3fb806350d78d10
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000723aacd0195aa04e95e46ddafae6a935aafc23201e2cd0f4c7b4ac2d5cec18a1000000000e8000000002000020000000df674fecd23900f50139951a0ba23fe4e50c95630f1ae3a3186e007638fd49be200000009a97db7e63053ecdc13ff647513ccbedd026e8eb24edde525b1ab9fdefab2d0c40000000318581b2e0cf9e688c0523e92992b3dd1d7eaaf1e32ea01349a945adb017e71c28a8f71ad2c103f84e5099248a5511389e1fbc469c57adcf289c01276a1f2061 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E3B4C21-CF2C-11EC-A2A7-5AC3572C4626} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02aeff53863d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000002921d6562590120f294084cc9d15e95a56d56d8d48c67f889b05ee5357090ce7000000000e8000000002000020000000c4c3453f1794f435e2bd19aa5ac08b3de12e7aea85bdac9e5de55af01948f1f690000000ee02a7289370181d5c4e90a2bfe323cb31a6683d2254bad15246cb5cd22a10e4762a9d1a9d0cfbcaa31e8ba59987d68839a1fe6dd9a268f03578f022ead443c6a937562787e837e049f16644e51b7ac17eb476a1ceb6297147cf2ee25be77b52eb2f5ef6fc6f73bd902b5769642fec0670dd44f0f39f7fa70fc520ce87663a4035ef6964088bdc5ceed581962af98a7b40000000717dcc3cd5dcfe9bbe387420242afa41c1667544589a881af29c95573cd5a853cec128f097f93d8047dcf711d0c7b65b8469f556abb89eac84f8e04e2b897a30 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "358819900" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2000 iexplore.exe 2000 iexplore.exe 1328 IEXPLORE.EXE 1328 IEXPLORE.EXE 1328 IEXPLORE.EXE 1328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2000 wrote to memory of 1328 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1328 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1328 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1328 2000 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Onedrives\Onedrive1\OFE.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VGPIEH9O.txtFilesize
601B
MD51437cff0036daad922222b159131bc35
SHA13ce1116bb7cdfa813b98fbaea975ac019d00895a
SHA256cde5b77580a9dd295bc4759f487ac51dfa2eb23cb439ec079eda6dcc3d29f0e2
SHA512eeaf4b56707197f30cc81493ee2da9ce4991fd57d25a1dc9aaa83fbee31e36f5236901611def433948ace8f833464868373e4d56d81254543d31c4e806c559a1