Resubmissions
14-09-2022 08:18
220914-j7mfjshfe3 114-09-2022 08:17
220914-j63q5shfd7 114-09-2022 08:17
220914-j6s7psdddm 114-09-2022 08:10
220914-j244eaddcn 114-09-2022 08:06
220914-jzhgmaddcj 1Analysis
-
max time kernel
339s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2022 08:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://snorefamiliarsiege.com
Resource
win7-20220812-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://snorefamiliarsiege.com
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
https://snorefamiliarsiege.com
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2567840623" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2578152864" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f5099b11c8d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602abf9d11c8d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C48408DB-3404-11ED-A0EE-5ECEF326E858} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e11c9b11c8d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369908035" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2567840623" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984209" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30984209" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000094f35a3f1d8792cd5c63fdda9faff2c58ae0d573b058bd68d334c8efa5232e02000000000e80000000020000200000009842415d50b800f742bdd56df2aba463313367035c83a56258c7baebf3fab4702000000007d71b4e2db534b2137be6b47d510d4f4e6be70aba2a9617229495e115e7691040000000d79cdf5fd2e2bd82bf490cad17f0abb4445cfa1cefff5c40ae537d567eb13fb8fbe8de6e800c9b3412c5370b9195f2ef38e45a41f14f486ff52816cef45394a9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000000952599e086024fddc82b24109703dafaf1d46b4d3836eeb9bdcf4e64216442e000000000e800000000200002000000093fab1b3b37ce543c08d2adf0590f756170dd55816515cb3e12f1c3ccf05c0c7200000007e115bfd2877a1d77dd8683ac69c44431ff31ce2712ca45b51af5ee24b3121fa400000009ecdfd006ffb8ae5869ab65ecfb87e91af16b26c2a5e414834e52454e9113c190e0adda34d11d513dc20b2745d1a97db139174b9816d6044ae0b148f8667fb15 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000008ea003e7149332293d8958e1b83a93d111cb0d9d0e579bc4b1ff931297652613000000000e800000000200002000000091c56da9683741f9e0293698012fd7f8d20c823cc3f05dc5dd415bbff3d04e5d200000002d799b038f0a3972b994734bbdaeb85ef51ebba2c3fa933474e609ebb04baebd400000000aee248b57bd11465ff7aa844683318985315858752603a7d1ba7d2e7920a703c2a641548a3a4c95e89ce4fc307be43fce7dfbc68109bcb4cf0e8443853cd786 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4980 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4980 iexplore.exe 4980 iexplore.exe 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4724 4980 iexplore.exe 85 PID 4980 wrote to memory of 4724 4980 iexplore.exe 85 PID 4980 wrote to memory of 4724 4980 iexplore.exe 85 PID 2124 wrote to memory of 3904 2124 cmd.exe 109 PID 2124 wrote to memory of 3904 2124 cmd.exe 109 PID 2124 wrote to memory of 4000 2124 cmd.exe 110 PID 2124 wrote to memory of 4000 2124 cmd.exe 110 PID 2124 wrote to memory of 2548 2124 cmd.exe 112 PID 2124 wrote to memory of 2548 2124 cmd.exe 112 PID 2124 wrote to memory of 1588 2124 cmd.exe 113 PID 2124 wrote to memory of 1588 2124 cmd.exe 113 PID 2124 wrote to memory of 796 2124 cmd.exe 114 PID 2124 wrote to memory of 796 2124 cmd.exe 114
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://snorefamiliarsiege.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4980 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\TRACERT.EXEtracert www.snorefamilareseige.com2⤵PID:3904
-
-
C:\Windows\system32\TRACERT.EXEtracert www.snorefamiliareseige.com2⤵PID:4000
-
-
C:\Windows\system32\TRACERT.EXEtracert www.snorefamiliareseige.com2⤵PID:2548
-
-
C:\Windows\system32\TRACERT.EXEtracert www.snorefamiliarseige.com2⤵PID:1588
-
-
C:\Windows\system32\TRACERT.EXEtracert www.snorefamiliarsiege.com2⤵PID:796
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a3148353e71efa8ea5c96e24550925ef
SHA1e971625229098c2e622721baec3c845718a431e5
SHA2565aaeba37916dca0e9ea366c57bc04cf8b8d4b30367cc21bfb366f2811c159b22
SHA51249e50fdea77b949e0208786cdfcf1e7d2eca56ca2a64819f2a91966a035f1ff3f201ea3fbc12c790631ab0083c3c9ecdf96a1332105259ee0fbdabf6688e58b5
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563