Analysis
-
max time kernel
149s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 06:10
Static task
static1
Behavioral task
behavioral1
Sample
??????.url
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
??????.url
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
QQ??????.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
QQ??????.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
UnRAR.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
UnRAR.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
data.exe
Resource
win7-20220414-en
General
-
Target
??????.url
-
Size
219B
-
MD5
122e953f3a92541c27cc62db2d9bb0f7
-
SHA1
5c85d98b4bce0daac9631297ddb00b005161d131
-
SHA256
5bf9390d32df4da5ddb91425fc5002768a85305964a8e0cb8eda391b4b6511dd
-
SHA512
77240964186d2e9c9c73ed6bf13edccaeb40c0d8cbf477080c9a40a76d044964330e97421e4b45818bfbb2688e6bfaf6720a52f2efdd3b944f3624b1b5767583
Malware Config
Signatures
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6EAF631-FEC4-11EC-A814-FABB0CD78C51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec0000000000200000000001066000000010000200000005fd1c6b54d3d9f94bea28a75ef47b199d4e66ec9a4ef8bf7d03227051acc9bb6000000000e80000000020000200000005656adfb6ce951601d45e85ca3f76d5ece0f75c35c8bbe9ef1eb40999772159e200000001fe22b555f438dd5dea98fd50caa409625b0b69ef10a220a8a34298e59bca1dc40000000866b127e78cdf67c3fd85b6d6db9020e9737b197c48cf72bc0082370cf936c22152774bf5c1835eda13f592cf8c8015068fb447c92022f4750133a3fc8ba908a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364053196" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec0000000000200000000001066000000010000200000000b8072dbed64276e0ce884ca8b4d9133f2177ed5637de6ad2cffb0f31a8b325c000000000e8000000002000020000000cfd554a3749a308872998bfbdaccfc6193ba458b29ccaa9cff8bb65fd640f77f90000000fcb2fb521a92f5c7605f6b9e8668f73325f15cf95963b3d810b9b3a5df5ec0d452f85ba1827e4dccf1329f7941b57de6bc906ea0ba8cf01df3e33a4dd55fef1670860866a2614f687af246fd9a8f3ac28caccd4fdb08490ba1fca3a700401004df6cbd4a9c5e9756d9c94978a9433593be295fc5c6c55fb6a4b90f04968626eeaeee529d9a45a2ea24b9b92a3fe432f3400000001d8b3a50f71e95a86608b0a7ab9c00fdc1eee6fb8547f7aa0c5ee6ee7fa045dc8b66f2224635fc63614431390dcfb5161fbec3b3d952750d03190ac0a1bb9a3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9068d0ded192d801 iexplore.exe -
NTFS ADS 1 IoCs
Processes:
IEXPLORE.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\______.url:favicon IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1876 iexplore.exe 1876 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1876 wrote to memory of 1984 1876 iexplore.exe IEXPLORE.EXE PID 1876 wrote to memory of 1984 1876 iexplore.exe IEXPLORE.EXE PID 1876 wrote to memory of 1984 1876 iexplore.exe IEXPLORE.EXE PID 1876 wrote to memory of 1984 1876 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\______.url1⤵
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9os4y76\imagestore.datFilesize
5KB
MD575104b3d8b01dc71075a1d0f4b7f2e2f
SHA14a0c5d9e7ecc0e5151ca03945da30c81f19e8a85
SHA2563f331ddebd450c27254894c24f046e1de6e0adc6a62987bbc7a36d4f9d1e754a
SHA51282e2a4a987681dc505bf3648d83220bc07e920d079f936d6f7894913231bee0c728c44848b1693f55adff0d8066a23417514596da90b00fb7ed39851ca84ef1a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S2HHBB26.txtFilesize
604B
MD5fa993ac6fc910ecf81a83de3b1881ede
SHA138f4b6d5b36a901dcd43b232f74b4ad22b531df8
SHA25630d4a1887804b44edad167d30581dc1e7f9926a6159ccc8859189ff7a5828b9d
SHA512aeddf9eb1cd0cd69f67f9b11addb9a6818c1d9d0f41fc69c136af45d8207a8ca4ae9dc394d804c1202e40bc6e69c954ebd2826c63a3471f70aa5d4ba1057f146
-
memory/1712-54-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmpFilesize
8KB
-
memory/1712-55-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB