Resubmissions
08-09-2022 17:44
220908-wblklafbe7 307-09-2022 00:27
220907-arqnlaafh7 105-09-2022 16:52
220905-vdthjsehd3 305-09-2022 16:42
220905-t7p7jsegc2 705-09-2022 16:37
220905-t49f1sefh3 331-08-2022 06:37
220831-hdwlpabhc7 131-08-2022 06:32
220831-haw32sabhk 1031-08-2022 05:40
220831-gcy5rahffl 10Analysis
-
max time kernel
188s -
max time network
220s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-09-2022 17:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://20.7.14.99/server/
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
http://20.7.14.99/server/
Resource
win10v2004-20220812-en
General
-
Target
http://20.7.14.99/server/
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369424076" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000f5be1ad927ef23a48a704112d097a92f33b4e5783d215f8c17f9a4fa5b822227000000000e80000000020000200000008539b7c07dad39fafc245f51884cfa985150fa19c1ae2a9809cea51360b3f205900000003d0b0fef390b43f883d5b2715e7c64d5302fb67f7c0647babbf357f3de7285ffd88eb38ec9290def6eba952ee05a451ae2d9a9f90dce9ba66c9b64f648dbe9fc8ed3e5331d0449cd2d1056eb86b459dcbe4e226f43dc530f38542834d362771d2ab0286b188090433515374df291afba33c453df82d798125c8f6bb0f6c58f6d3bdb20fbac56d6d57ca2b31aca527da9400000008a2e839d8dbfe424910bd97e4dfefb065a0cdf33d135aa18c0e53e6fdaf3300026f9a8fe3495134457be818990e27d3fae2ffa588a1d995cb87efe5f89e70fe5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6C10811-2F9D-11ED-A584-DA3F1CB7DA19} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000363fd9199227504dcc560b8614fd9289e01332b730bc89a782dc4757b439d801000000000e80000000020000200000007be829db21f0123107f0dd04fef87ad58da1dbf57b7d0a8a684e2400274ea6352000000047aebd166b5c1ebb23aea8cb5e1fa7d1ed82b73f9b6dc7a272f25333174aa14240000000642ef05c009acb3980be1e2e2231e4596caa1985267309d576985e0b86a0235077c1fb6a296c52426f561a187d07f925717a4304683f409fbb2857d56fce6ec0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0011c1d0aac3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1720 iexplore.exe 1720 iexplore.exe 592 IEXPLORE.EXE 592 IEXPLORE.EXE 592 IEXPLORE.EXE 592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1720 wrote to memory of 592 1720 iexplore.exe IEXPLORE.EXE PID 1720 wrote to memory of 592 1720 iexplore.exe IEXPLORE.EXE PID 1720 wrote to memory of 592 1720 iexplore.exe IEXPLORE.EXE PID 1720 wrote to memory of 592 1720 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://20.7.14.99/server/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.datFilesize
34KB
MD5126dc0b0fbf60f41af9ab9e9d9cfb322
SHA1750e416d75b970d26398b24bf94a7cafa9c2843c
SHA256e49f4b039f667f11753183a16091231eb2bccd102c94d40e97f78c53af346f78
SHA512359ce844a8d9e8eb98f8978c2d3cc5716a84e26a9ff11c7be7137d334da11848b413db0d48709d97fe4b9eedeef34a4686254564e3459f92c6d3ab0cd201dbf3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\31VARSVK.txtFilesize
608B
MD5215a1e5741ed09043a890450eae29301
SHA1eb97889d46f18a145cb9c37442d2db73df7d5219
SHA256a801a918d7ed71c551a5de5bfbb97e7515309b04306460e63bf239839d3c7c45
SHA512162c01c17ad59b823e0ca7916ab142d16a41665ed365944cda4a16e2f45960f091b3ab76ec8c19aff98f22ddd04670f2a0e3b6ceb655f4a35b28355955608c07