Analysis
-
max time kernel
73s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-06-2022 00:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://email.rinnai.us/e3t/Ctc/RG+113/cz1pB04/VVCX8d5fLScfW4BFygt7mRnXGW8_npSB4Lfk42N72QT-p3cf2kV1-WJV7CgDhKW8J36mK5WzC8GW7WQbkC3QS4C4W8H88zG7n495GW6BbYnf36CcZNVPYv6_8QfCMsW1rFgbf7jCCSwW70fCLY3fDbswW1Zz7Rr2yh40SW1p4tN_8wLpkgW87jsCW1xbFg0Vpn6s-6m8jKwW7hwdMw2zjv49W4cQBX32Dv9vKW44P7sj38_FPNW2TXzFx36MYR3VpP-qk5Z9YYkW82gD7g7fzCT0W1rcKkt58dZDcW2d8T919bk7K1W3kZm2B3QcQWBN5GcmbhC5GGxW8sXTRM2yntjMW5WBszN4tpKGHW2PW_fB2l3f-_385L1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
https://email.rinnai.us/e3t/Ctc/RG+113/cz1pB04/VVCX8d5fLScfW4BFygt7mRnXGW8_npSB4Lfk42N72QT-p3cf2kV1-WJV7CgDhKW8J36mK5WzC8GW7WQbkC3QS4C4W8H88zG7n495GW6BbYnf36CcZNVPYv6_8QfCMsW1rFgbf7jCCSwW70fCLY3fDbswW1Zz7Rr2yh40SW1p4tN_8wLpkgW87jsCW1xbFg0Vpn6s-6m8jKwW7hwdMw2zjv49W4cQBX32Dv9vKW44P7sj38_FPNW2TXzFx36MYR3VpP-qk5Z9YYkW82gD7g7fzCT0W1rcKkt58dZDcW2d8T919bk7K1W3kZm2B3QcQWBN5GcmbhC5GGxW8sXTRM2yntjMW5WBszN4tpKGHW2PW_fB2l3f-_385L1
Resource
win10v2004-20220414-en
General
-
Target
https://email.rinnai.us/e3t/Ctc/RG+113/cz1pB04/VVCX8d5fLScfW4BFygt7mRnXGW8_npSB4Lfk42N72QT-p3cf2kV1-WJV7CgDhKW8J36mK5WzC8GW7WQbkC3QS4C4W8H88zG7n495GW6BbYnf36CcZNVPYv6_8QfCMsW1rFgbf7jCCSwW70fCLY3fDbswW1Zz7Rr2yh40SW1p4tN_8wLpkgW87jsCW1xbFg0Vpn6s-6m8jKwW7hwdMw2zjv49W4cQBX32Dv9vKW44P7sj38_FPNW2TXzFx36MYR3VpP-qk5Z9YYkW82gD7g7fzCT0W1rcKkt58dZDcW2d8T919bk7K1W3kZm2B3QcQWBN5GcmbhC5GGxW8sXTRM2yntjMW5WBszN4tpKGHW2PW_fB2l3f-_385L1
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30965640" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3003237628" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000183fddab3132b184b8a49c34de580b92cb8e8eaf5fdd8119fbe02cbc719f7e04000000000e8000000002000020000000d31b42ecefb0d7030eb1315566d9177a7d4ff9c8f46e40c8711d33ac720554fb20000000149ad5db674646e78a10a79e9ef9019894a59aa5c262acc2e8a851f63c2d5e4440000000d4dbe3280a9797c3e20c188177f41bccdf7c6b4b815a8ab1ecd179bb34d6004b7e326d324e9dcbd5e1b6b10ad6a0f5b53da9563f7f429245c6468ca0d1761ab9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000342a1fdfbe24a6a48dde04873152535fd78ac4335cd226d22dd4e3212d1da423000000000e8000000002000020000000cc2a61437651ebcb46fe58e8e4bd047206d0a1b6c0139962fdd3e8d153d1e4d520000000f841dad9d80bd3b34de24db797306127c7c6010df7b58e39b844757110d290004000000039b0f952632d61cd0736a3a2fbbf62749ab97189e398028fdd6a0e2836eec26214a301487118c03a7115c6de55e3ac4fd2a571b5621b7a2c22e0e701030abdd1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361932754" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DE9838C9-EB7B-11EC-AD90-66F9B3FFC396} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3003237628" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30965640" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3014175385" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "7" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f2c4b6887fd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30965640" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100cb9b6887fd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "7" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "7" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "6" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies registry class 1 IoCs
Processes:
IEXPLORE.EXEdescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1809750270-3141839489-3074374771-1000\{DB993640-7FDE-4720-8A3F-71620DE9A15B} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3872 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3872 iexplore.exe 3872 iexplore.exe 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3872 wrote to memory of 2060 3872 iexplore.exe IEXPLORE.EXE PID 3872 wrote to memory of 2060 3872 iexplore.exe IEXPLORE.EXE PID 3872 wrote to memory of 2060 3872 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://email.rinnai.us/e3t/Ctc/RG+113/cz1pB04/VVCX8d5fLScfW4BFygt7mRnXGW8_npSB4Lfk42N72QT-p3cf2kV1-WJV7CgDhKW8J36mK5WzC8GW7WQbkC3QS4C4W8H88zG7n495GW6BbYnf36CcZNVPYv6_8QfCMsW1rFgbf7jCCSwW70fCLY3fDbswW1Zz7Rr2yh40SW1p4tN_8wLpkgW87jsCW1xbFg0Vpn6s-6m8jKwW7hwdMw2zjv49W4cQBX32Dv9vKW44P7sj38_FPNW2TXzFx36MYR3VpP-qk5Z9YYkW82gD7g7fzCT0W1rcKkt58dZDcW2d8T919bk7K1W3kZm2B3QcQWBN5GcmbhC5GGxW8sXTRM2yntjMW5WBszN4tpKGHW2PW_fB2l3f-_385L11⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3872 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD53abc0a8790937f795a488ce6f4b010af
SHA11ec28317a7390b615073819cf32874e8c57e9d39
SHA256027ba6cfa1664a9e34b02c0f81970a6feb213ec9b405c8488361ed23a9e1cb50
SHA512f8a026477fa25c194825fbb4c9a470dffcf4a8b85f575128a90042b54c5c30b6aab1cd6f70625423b21c4383f1702124c838788f862cf3313e2088898198a4c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5607b3d466d71177fe71cd395acc7cbf4
SHA1319acb11201a1662b1a282f6d7922dfbe1d3dd2f
SHA256a3549d03c602178b25eb5a341e55dd5a6aa9475c0c81259dd998692d2e3e9f22
SHA51211a1cbb51edabf6ae46e364632a01f05db56d271eccf9d332ddf5953a0669819fdd37383997196b09a55b918bbcaceede24469772bf100da256963874781b381
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.datFilesize
5KB
MD5ecef9aeacc773c074c76903c60d5aeef
SHA19d9c54f02f409f278b2d686cfb1969042cf229f0
SHA256f3ecbb3cab1f482c9a4cca3b225bacd247b20d872c9a2604164b20c8aeda3df0
SHA51221046ccf611fa1cdd2c631b02feef7be6ee20e60cac1142088c8873428bd2d417688c2dbbef31200ffbef4587cfc0b9c17a7ae3bcc698d89674020915912055a