Overview
overview
1Static
static
URLScan
urlscan
http://Github.com/pi...
windows7_x64
1http://Github.com/pi...
windows10_x64
1http://Github.com/pi...
windows10-2004_x64
1http://Github.com/pi...
windows11_x64
http://Github.com/pi...
android_x64
1http://Github.com/pi...
android_x64
1http://Github.com/pi...
android_x86
1http://Github.com/pi...
macos_amd64
1http://Github.com/pi...
linux_armhf
http://Github.com/pi...
linux_mips
http://Github.com/pi...
linux_mipsel
http://Github.com/pi...
linux_amd64
Analysis
-
max time kernel
1737s -
max time network
1630s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 10:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Github.com/pixiedustattack
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
http://Github.com/pixiedustattack
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
http://Github.com/pixiedustattack
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
http://Github.com/pixiedustattack
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
http://Github.com/pixiedustattack
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
http://Github.com/pixiedustattack
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
http://Github.com/pixiedustattack
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
http://Github.com/pixiedustattack
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
http://Github.com/pixiedustattack
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
http://Github.com/pixiedustattack
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
http://Github.com/pixiedustattack
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
http://Github.com/pixiedustattack
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
http://Github.com/pixiedustattack
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363788584" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD126B91-FC5C-11EC-A5DE-62D05D50A506} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f020e5ad6990d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000001c84e5a88c464443e2b13ab509af36c5f0ea8f2d14a7b26343bb3a432cacc7c1000000000e80000000020000200000006903fd294bf6b81616778749f89962c1bf5970d5d980b2391571cebe38c5802790000000e606c59ebca92bc8ca01cac05261b2e6f843b6571f1a08e114c54999780f2287e59d339484b90162f5ce4e4a6fbb8d93e8792673bc14a761b686f8465dfc3c5fde53328117359233f71b2188c00f6ec24a45673818fc36de597450923df7a254a65bc7f9c6e480e207a161c5dea72cc963b405db4aad97dff1a1e770bce4c8d0be3f6c841240f7e0e806e63b5c80968040000000f6c62c7138e554becd5ef6ba14d6911268ee0f8e845956be67aaacd6ea2a955003abcd6e3a0bcce773254ddaad8172c0d28e0ef0c527fbcb6fcbd896a61c3576 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000ecd838805b8d52a45e50382a5a621faf2273b1e06ea7fce5af72e907fe8b517b000000000e8000000002000020000000b6e652829986625af3b01bd744d5ceca00d6196209bf605b83be76e607f5d9e5200000005758c2ed8b6f7c68da56d38ef3e809bcb7b001cca9187a1eeeb556dffbb8aed44000000075fc733e9cec9441c0706fb55c073795fdccfd101a9b2daefa2a4e93ff3793392728cab84f1644ce507266ada53c01b860545a578735e0c86031a7f67627fa01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 548 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 548 iexplore.exe 548 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 548 wrote to memory of 2000 548 iexplore.exe IEXPLORE.EXE PID 548 wrote to memory of 2000 548 iexplore.exe IEXPLORE.EXE PID 548 wrote to memory of 2000 548 iexplore.exe IEXPLORE.EXE PID 548 wrote to memory of 2000 548 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://Github.com/pixiedustattack1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f3969152fcfaaebecd235595536b5f2d
SHA1fe69f6e564c5b8dd3798398537c82f807b024d22
SHA25654aa11f526556186e00808122d8bf36566605ded6af203a96c6565bc78ae6366
SHA5126c6f6da7fc1e1014caf8b50f28055e0b97d871fa6c197fcc5896731a75cfb6c5ce9a641bcbe7b03a15e169e17a47a0522f093ba64f2aa3e4e5e98371caf66720
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YLASMNSM.txtFilesize
607B
MD557d159fbb04516c0e4b095d8d4cd7727
SHA182d53778e236ea5a95bfd52feb4ce8abacdc2f01
SHA2565351b143dd48b777acddd716b26c3009a2b7bd56a48d21edae7dd1ca25dbe86f
SHA5127365dc97f2f6929d96b4bbe94ded9ead097b00dae55a19335731e5399e87a835475102727bb597bf130f6486abff85329ed38fd6d81ec3dfeecd28bb13091d8f