Analysis
-
max time kernel
78s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 08:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://links.bissspuxi.com/?ref=Iq8AABC-6kQITPs5p0rMbD8wPOK9CC0qAQAAAOYSiIKEAK8LC3zutVwvpC06tqVT5tUsdW8IaIyyi634VmJcg9J5BLibB-mbD3hdmUpNIsb4xxqq4NK5g3RNCkUKEtcFhHlxk7FNQcBwn07EyOI69A1jGCu6wfWd8Tbqd3UoqTEmTndy9puH5o3VqjEjaPkyfwnozl9HISy_xIRG9chx_P4xA22yu3vtM6qBhXY3y8Ayg9e2WLkDMPVOrPHlBgVJYtF-VEv0yek_n1662C4pt2xTMFFoosxuUR43X59lqIHnHAixdNUTw-uOUZLdUhidCrR5hiXnQ9SFAdp1MPmd3CwDDq1zEaVf11h2lg
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
http://links.bissspuxi.com/?ref=Iq8AABC-6kQITPs5p0rMbD8wPOK9CC0qAQAAAOYSiIKEAK8LC3zutVwvpC06tqVT5tUsdW8IaIyyi634VmJcg9J5BLibB-mbD3hdmUpNIsb4xxqq4NK5g3RNCkUKEtcFhHlxk7FNQcBwn07EyOI69A1jGCu6wfWd8Tbqd3UoqTEmTndy9puH5o3VqjEjaPkyfwnozl9HISy_xIRG9chx_P4xA22yu3vtM6qBhXY3y8Ayg9e2WLkDMPVOrPHlBgVJYtF-VEv0yek_n1662C4pt2xTMFFoosxuUR43X59lqIHnHAixdNUTw-uOUZLdUhidCrR5hiXnQ9SFAdp1MPmd3CwDDq1zEaVf11h2lg
Resource
win10v2004-20220721-en
General
-
Target
http://links.bissspuxi.com/?ref=Iq8AABC-6kQITPs5p0rMbD8wPOK9CC0qAQAAAOYSiIKEAK8LC3zutVwvpC06tqVT5tUsdW8IaIyyi634VmJcg9J5BLibB-mbD3hdmUpNIsb4xxqq4NK5g3RNCkUKEtcFhHlxk7FNQcBwn07EyOI69A1jGCu6wfWd8Tbqd3UoqTEmTndy9puH5o3VqjEjaPkyfwnozl9HISy_xIRG9chx_P4xA22yu3vtM6qBhXY3y8Ayg9e2WLkDMPVOrPHlBgVJYtF-VEv0yek_n1662C4pt2xTMFFoosxuUR43X59lqIHnHAixdNUTw-uOUZLdUhidCrR5hiXnQ9SFAdp1MPmd3CwDDq1zEaVf11h2lg
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30975961" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30975961" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30975961" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2403111869" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00537699d9a7d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366365530" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c462900f48ae714cae0346dd4284bdb900000000020000000000106600000001000020000000661b529370450da7caf85ece4431afc2393dbb1d15cd913ee9f45c504644d521000000000e8000000002000020000000b2ae0d49f608649c27bf827db71f72a676e16a3d5eef480db587e3858ab4a56120000000e408415ec0bd7fac6d38202aaa08afe6dad1556569e3a55e0710a07993cbc4ae40000000ee3178720b8686872b015428e721e5555d26e835578aba68b06cad57827fb4f4d6db83bd6ae8cb120d23a12f4e941f3efee811bf38fe2f0e279f5a9630821ec8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2413737147" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0398299d9a7d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2403111869" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BAD90E27-13CC-11ED-9262-FEA589ECC62A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c462900f48ae714cae0346dd4284bdb900000000020000000000106600000001000020000000e202bc5fac9b538f673653326ad452b0033a89692641178afc038bd1891277d6000000000e8000000002000020000000f2a9d64425142662cc510548b54068b2852a4ab0821bf731a1501d8a3a3d355e200000008b275e88a69f035082f99046ce961fa5861c2d1390a10869857189fc963e5b2f400000001c1af702e583b79cf470d1bb2a930044bdea54c58a07dbc85f5b61d7f88f28aa794b86533e1e25299ff375638bb63e56174115826c00ff11544e81c28c7ba773 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1440 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1440 iexplore.exe 1440 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1440 wrote to memory of 2368 1440 iexplore.exe IEXPLORE.EXE PID 1440 wrote to memory of 2368 1440 iexplore.exe IEXPLORE.EXE PID 1440 wrote to memory of 2368 1440 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://links.bissspuxi.com/?ref=Iq8AABC-6kQITPs5p0rMbD8wPOK9CC0qAQAAAOYSiIKEAK8LC3zutVwvpC06tqVT5tUsdW8IaIyyi634VmJcg9J5BLibB-mbD3hdmUpNIsb4xxqq4NK5g3RNCkUKEtcFhHlxk7FNQcBwn07EyOI69A1jGCu6wfWd8Tbqd3UoqTEmTndy9puH5o3VqjEjaPkyfwnozl9HISy_xIRG9chx_P4xA22yu3vtM6qBhXY3y8Ayg9e2WLkDMPVOrPHlBgVJYtF-VEv0yek_n1662C4pt2xTMFFoosxuUR43X59lqIHnHAixdNUTw-uOUZLdUhidCrR5hiXnQ9SFAdp1MPmd3CwDDq1zEaVf11h2lg1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD55e73aab8e9414a4f86ba309082fffd18
SHA17d820117aabda997625d8d0259d773cc4728df28
SHA25666acaff9f0d8fe9aa5f6a2d559374fae83845f067897192a5144d24dac76867c
SHA51284fc54bec41ae4d676e59d030aa40805e71da3bfd4b20f56491416e37854fa66d5d10a2e773479a8fe3221b8a76a49f05748f2b2da7db51ba22dc239b5e6242d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8FFilesize
7KB
MD56d339a3220150e29ed72f0571a55386f
SHA1bf30946cc25eeef3ad6de44827eacf443104cab7
SHA2567f827a9894162af9187f32ffcbdf4c7accb769427523b056909b3a9c2e483933
SHA512aef317187d300d8842826964ef893441870d20d6726004c235eed3c5f1fa0bbe5b8738e461a263459924216f6af31c46cca87d7adaff4feaae95a6dcea5c5c79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5772fa18ca7bae0e11f278773fdc9743e
SHA115feec6fe44febc062b197bfe47e3e018f00bcc7
SHA2564cb5a06a42a486ad157e35f21abbb9373f2fa88b47ce9c697b7f257981a9d1e3
SHA512b996c1f4938283ed9447805de1b883aaf41cb8cad3449a3bb6518f6c9549c70e26e190e21d0526f703826e887b76538496dc1491aa5a2e1a6ae82f85e224cb4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8FFilesize
224B
MD53b9e560b27bc00c38243195725cc3778
SHA1961b17d54836d87a0b9b07e8fd78b8f10c468266
SHA256e5d602e0b5bdbb07c8c12146a94e6175ead3c06649767e63185076671767219a
SHA51292375c08549ba7e8e583b81e0c014143b4af3546aa594141eb9b13e1e0202720c424b92740483984d089b7808072e0b716230d39bb55dbd0ad26d9eb12513fdf