Overview
overview
1Static
static
2d54c802f9...50.zip
windows7_x64
12d54c802f9...50.zip
windows10-2004_x64
1files/Conv....en.js
windows7_x64
1files/Conv....en.js
windows10-2004_x64
1files/Conv...ore.js
windows7_x64
1files/Conv...ore.js
windows10-2004_x64
1files/Me.html
windows7_x64
1files/Me.html
windows10-2004_x64
1files/jque...min.js
windows7_x64
1files/jque...min.js
windows10-2004_x64
1indexx.html
windows7_x64
1indexx.html
windows10-2004_x64
1Analysis
-
max time kernel
107s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-06-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
2d54c802f97adf6613a6dc5cde426c8127ea6df1aa7efd1aad02480980900250.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2d54c802f97adf6613a6dc5cde426c8127ea6df1aa7efd1aad02480980900250.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
files/ConvergedLoginPaginatedStrings.en.js
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
files/ConvergedLoginPaginatedStrings.en.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
files/ConvergedLogin_PCore.js
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
files/ConvergedLogin_PCore.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
files/Me.html
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
files/Me.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
files/jquery-1.9.1.min.js
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
files/jquery-1.9.1.min.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
indexx.html
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
indexx.html
Resource
win10v2004-20220414-en
General
-
Target
files/Me.html
-
Size
2KB
-
MD5
cc64f2b1be564864ef54387123cff924
-
SHA1
e8eb443e51f40569bf70ccd561bced5aa0f424e1
-
SHA256
47561dcf8de30f82a5e749bafc875d3703fd6c7f7d0930e42ef58888b06b1a11
-
SHA512
8af809fc1bd82abcf60778779d4c8f5d5d900fbdde5c4af9a4b94ee013790e15144977524d8f5435dfa968d04e8aa1ac2bd529104cdcf284edf25c512f7ab859
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98677331-ED17-11EC-AE54-7EE61918B1DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000052c24ea1ca75688d0f46eece5d062b3657c121c48927640db08782a0b8a5076000000000e800000000200002000000043201ca920fea199db22cf2dfd05ac9599ea848637dfe996cad63c1f6991463b90000000c81f8d0cac2279c68a9c9a01cb401652a074214ed07ff088e45318cb76b63f1113e6f6b09b069c89c85386f83e7f676ee040f3591c6e227b1418b9b035971462940c8095b0fc7335b347a99e41e5184cc4c34e8bb7260e652cfca6b1d871550d02c81b9d9029d398292cdfc551538317f7ab1b3b57cfb6524a03f8b3a6499a809f57157a33711df647b94e1629aaa29640000000d3d028405609c0091d929a80f000111d57a5867ed030b30fc67e90c780e0bab2f5cc83ee4f7915b807a26715f2b728d089f7ce7095f651d67011297d8a97b6d7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362109597" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3039de6f2481d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000003d0ab28c081571b3c43da4e075eed3a494d9c982d65da80cd85d93d20b72f736000000000e8000000002000020000000a0243272cc4be3d71c4e71bde24b6cb071cb1a2f1dcf35e5beae7c315686c2262000000020020da6551390cad8d4b8eac010dda6dbed54a0c87b2dcdaf3d461c4130177940000000a1d35400e98268c1c95381bb446bde6b98dd356e3e4880045dde0f4e41f6b3f1e42b5d4bf00234942449603d5614e38208f0fb9dbce3f8032a4c3993915580bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1364 iexplore.exe 1364 iexplore.exe 840 IEXPLORE.EXE 840 IEXPLORE.EXE 840 IEXPLORE.EXE 840 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1364 wrote to memory of 840 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 840 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 840 1364 iexplore.exe IEXPLORE.EXE PID 1364 wrote to memory of 840 1364 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\files\Me.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YZOQL7DJ.txtFilesize
604B
MD58905ccdb451b8d70410e9a8bb2c3f0af
SHA160433508559b47248f143c29e1bed1eb19b41394
SHA256ce7e3ca75f0e4f26f4f8dabff1d9dc184ff04e68af34c60452356c45a14859b3
SHA512860ec2573193222c04d6cf5f4c172519eaa30ddcc40d2c7b2e0b484b6d52687d89944cd66e8867011e2253e53d5dd26321ceb0f42602dac564dba60f419b4b37