Overview
overview
1Static
static
URLScan
urlscan
1http://www.gmail.com
windows7_x64
1http://www.gmail.com
windows10-2004_x64
1http://www.gmail.com
android_x86
1http://www.gmail.com
android_x64
1http://www.gmail.com
android_x64
1http://www.gmail.com
macos_amd64
1http://www.gmail.com
linux_amd64
http://www.gmail.com
linux_armhf
http://www.gmail.com
linux_mips
http://www.gmail.com
linux_mipsel
Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 04:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.gmail.com
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
http://www.gmail.com
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
http://www.gmail.com
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral4
Sample
http://www.gmail.com
Resource
android-x64-20220621-en
Behavioral task
behavioral5
Sample
http://www.gmail.com
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral6
Sample
http://www.gmail.com
Resource
macos-20220504-en
Behavioral task
behavioral7
Sample
http://www.gmail.com
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral8
Sample
http://www.gmail.com
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
http://www.gmail.com
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral10
Sample
http://www.gmail.com
Resource
debian9-mipsel-en-20211208
General
-
Target
http://www.gmail.com
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09425820391d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000001bef0e90f5437a756bee975dc89a8bbc60764e171ba86855ad5c7f58443754f5000000000e8000000002000020000000566ff829a1f9d95bcea39a247664e1a76590d4000576eeca25beeada7b2f991190000000c68f67a7f27ded11d88185698329b0ece3c3473411a61d7e56df8869239581e38ecd55dfb3fc08fbd235035163f915f051e380887f2ecf9fa21bc5a9f0346c6c6817d45ababcec5712d362ee879abc3fda2d4c3172d54e6a8ada7905afa606638c81a7d8c43ed5a461e4d539abcf3ef0fb456e58cc18553962aafe04da7082237b10a2302dfa0c8323e60029b7988e7d400000000aedf2e6fcf48d5d0f5f76d78bd29885512b673b50cdbdca5f4bd94ca5a31e9ee22efaf57b8f585b8b164d21a346968e03bc7d59c9b9516c71f6d80feb1696a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363854658" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\accounts.google.com\ = "7" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "7" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000003971f603905c878e2243ae2370e29068ca39e79961bc556088fefb533eb4cac4000000000e800000000200002000000021e3e0e611f72256943321b60b254cbe0bb269e53afda41512ec0c34c40ac61c20000000af9ae0be3812cd08dbfc88655dcd4b91e695c79ed98f8ac60fc0cf01e5fc99ab4000000082241ead211541832fa6b124a336899bb9231c8ed7adbc0b45294df460ffdd566ddfe0336b7db4563c3f398146204f266a090b2c54ae9497184d7da2c7878248 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A654C351-FCF6-11EC-850F-E6BBD082ACA2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "7" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1852 iexplore.exe 1852 iexplore.exe 620 IEXPLORE.EXE 620 IEXPLORE.EXE 620 IEXPLORE.EXE 620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1852 wrote to memory of 620 1852 iexplore.exe IEXPLORE.EXE PID 1852 wrote to memory of 620 1852 iexplore.exe IEXPLORE.EXE PID 1852 wrote to memory of 620 1852 iexplore.exe IEXPLORE.EXE PID 1852 wrote to memory of 620 1852 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.gmail.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50047ff2cd41f16eda4ccbe061014c725
SHA1cb6084092d0cd4b36b9a2c94de7ba987dca96986
SHA2569cfbc90bcd7aae185e32db155164bcc3221a8f73868fcaf2eba10ff8f5c942f7
SHA51276137e4d192568220cb11aa33fc4c711d31a358b3bcedd21872030de39711d973fb59c1b885a6a289c0d2710b8f22bd70e64a548d30cb8026b95838ebfce6987
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\k007hrg\imagestore.datFilesize
9KB
MD5d8054fbde918a6cfa7ef96732f6d4b93
SHA1a0e63b702cacc07ce8b6a3f684541fd197db0308
SHA256bd8a61792b664b0fa53072c9696f4d8da450096b629d3704eb0c882047290313
SHA512544222a3074f7bf295a5518dcfc0850f5ac01fceb57153cc815c44572e256bab8fb34219acf53d63575229d9017f5fdcdc682c7aa3bed174a1dd100e9bd17924
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IJIVKRPK.txtFilesize
604B
MD597f9d40984b0453e541f2482c734cebb
SHA113be77113b3b84c86f2ef8758cb908fd9795ed8b
SHA25693fb0a8474e5f75d5517a6a5c2a85823383736b7ba654a118540c78503e6f319
SHA512c9ba3ce5dbf9aac2f483d13f91f80698090e170fa62d614c8d71bd3fddadb3df0d7011d4c1ee5384b730b03569854f96c14fbc8237de5a21a380c6721f32c790