Analysis
-
max time kernel
68s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 16:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://redirect.viglink.com/?BLZENNMKAXPYLWSPNJNT&out=WJOKNZ1688254193drzoopTSOVNMGZB%2E%76%64%31%6C%2E%70%69%63%73%2FHTK%2FVDJJBC%23%2EYzJGc2RtRmtiM0l1Wm1WeWNtVnlRR0p5YjNVdVkyOXRMblY1Omd0Z215dmhya3c=&key=537988228e2fcbcf4abed7388e7a38ff&KFCWZUWCXGFRGTJKLALK
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
https://redirect.viglink.com/?BLZENNMKAXPYLWSPNJNT&out=WJOKNZ1688254193drzoopTSOVNMGZB%2E%76%64%31%6C%2E%70%69%63%73%2FHTK%2FVDJJBC%23%2EYzJGc2RtRmtiM0l1Wm1WeWNtVnlRR0p5YjNVdVkyOXRMblY1Omd0Z215dmhya3c=&key=537988228e2fcbcf4abed7388e7a38ff&KFCWZUWCXGFRGTJKLALK
Resource
win10v2004-20220414-en
General
-
Target
https://redirect.viglink.com/?BLZENNMKAXPYLWSPNJNT&out=WJOKNZ1688254193drzoopTSOVNMGZB%2E%76%64%31%6C%2E%70%69%63%73%2FHTK%2FVDJJBC%23%2EYzJGc2RtRmtiM0l1Wm1WeWNtVnlRR0p5YjNVdVkyOXRMblY1Omd0Z215dmhya3c=&key=537988228e2fcbcf4abed7388e7a38ff&KFCWZUWCXGFRGTJKLALK
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f000000000200000000001066000000010000200000008922425f42009aedaa482687d7332713c6359dabf39574cf4dc213db94ae06a7000000000e80000000020000200000007a227410da6921487b3df87600ec380e3f9d144fcf4d009e0490f7dce466aa7c200000006888397bb7657404b83c4357c216783090397fbd3ec35efbcc0766bebfb61a3840000000cad55d123ece4a0a937d0b7aa2415c306102e796e95cc76c34b752f1fd4eeeed9020ca014758c15025e4766e8621e9c045501b18982bc5fafcc14c7b8a294281 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3A8B8E1-077E-11ED-8D3D-CE76330CF053} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f0000000002000000000010660000000100002000000037a627fd4eb066101e8e6dd53163bb147d1964cee37555a76056ea03569b0d1e000000000e8000000002000020000000d9bf5b50e4235ce71b2d4793281a90bb0f2eef1ae9833b726cf6753b6b4687b590000000c7b43e71d2afc91256aa21d84720dd5636c63447638ea9183ee217f3748fe74aaccb82752c7e130967eee49057dc5b28c4e36858469799b9a7c3ae9eb5abab6730bf9201e9ed95a5e3969ee03e4e4a800ef6220de71a30ae2612f8e4a888616a51c7c13cce18ed576ad05c6735195f54887ea5c690c6ba052585062b0285453afa601eed57f3dc57130df9f2546a6e3a400000001b7c81e00c65ea29d6327bd853c1034ec6be328a2dd8c119574ebc1204796edcccfe6745529ee70906bc64ccaa398f069cc23ccaa00ced2e9fef86e2bf59feb8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01c22d28b9bd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2000 iexplore.exe 2000 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2000 wrote to memory of 1072 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1072 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1072 2000 iexplore.exe IEXPLORE.EXE PID 2000 wrote to memory of 1072 2000 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://redirect.viglink.com/?BLZENNMKAXPYLWSPNJNT&out=WJOKNZ1688254193drzoopTSOVNMGZB%2E%76%64%31%6C%2E%70%69%63%73%2FHTK%2FVDJJBC%23%2EYzJGc2RtRmtiM0l1Wm1WeWNtVnlRR0p5YjNVdVkyOXRMblY1Omd0Z215dmhya3c=&key=537988228e2fcbcf4abed7388e7a38ff&KFCWZUWCXGFRGTJKLALK1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5bdcb93d57ca230fbc2291fbed44e3fe0
SHA19f8677a7f67e35708ff61269861d9f073befb872
SHA2565f5497b01d27414d8aca69c2dd12233711f4a6bf3f69733df2d1819f5ccfa289
SHA512f4bc2e5a2f503cb48d00b216093bc53fc5a983758904dfb1ac33a9cfef5b4bb4ced05c4a27ff3442f42823db59d681a2fa7fddc426dbd3c24f80ebb817d6df69
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AZWVVUOA.txtFilesize
605B
MD5477e290e41c167f91bcd2b933733bb37
SHA158e88be3b5d77c3f27c8490a379381ed269d0602
SHA256a74a4370c243da9ca4d90e744edc570684f3319e708ba37c8a6356190104b850
SHA512b932248c77775fed0e7bc065546df0f7deadda37123debbc30d99894d7dfc824786140850653067c7f68d111b4390daf85cb0193a539e86b6eb0a06879a3b7d8