Resubmissions
28-09-2022 06:46
220928-hjzwasfca3 128-09-2022 06:44
220928-hhwggsgchk 128-09-2022 06:35
220928-hcrlcafbg3 1028-09-2022 06:33
220928-hblcyafbf9 1Analysis
-
max time kernel
66s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 06:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://quarrelaimless.com/9b3cd056?nphmy=56&refer=https://mixdrop.co/f/ql3ndw6eb3ndw7&kw=["mixdrop","-","watch","beast","2022","720p","amzn","webrip","800mb","x264-galaxyrg"]&key=b8ec1bba676d04d104b756970b8e0395&scrWidth=1600&scrHeight=900&tz=-7&v=22.8.v.2&ship=&sub3=invoke_new&res=13.31&dev=r&psid=mixdrop.co&adb=n
Resource
win7-20220901-en
General
-
Target
http://quarrelaimless.com/9b3cd056?nphmy=56&refer=https://mixdrop.co/f/ql3ndw6eb3ndw7&kw=["mixdrop","-","watch","beast","2022","720p","amzn","webrip","800mb","x264-galaxyrg"]&key=b8ec1bba676d04d104b756970b8e0395&scrWidth=1600&scrHeight=900&tz=-7&v=22.8.v.2&ship=&sub3=invoke_new&res=13.31&dev=r&psid=mixdrop.co&adb=n
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88FB2CC1-3EF7-11ED-9D78-7225AF48583A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371111814" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000040b247a21b21b8e463029aa732285f6667a9bb9b5fa0bd48ab39cf269607bb10000000000e80000000020000200000002e22d50f9c51ac3374bc59581be2aa10694692535cc4cbfd9d428bb10705f17390000000488caa54928647c0a1108b1ee209b4f285ce4cc0c591d516a137946ec21db7d1e80a5eff3e76b5a7bf773fa3b18d198819fe958e3e707efc456ffe3fa54c0dc7180eb6cbefcb701d09aaa501275fef0adfc2abb3b8e292731b359ded8bb6daf43aa638062101fc4696245d351eb4ce13a99b2ec11518bf7f2087c778f4323e0a34d4f9e7e94f6ab985232515403689084000000007dda9114e22264305f911e6b05ea057e701f92a4f1cecb052b6f2d456469dfd1e6541bc3ab7783b7172cd67dd860060dadba6f63f84a0dc9644116532414bb3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000092723e7c0dfe40c1cc0bcc61441511c2061e1a6f2e0c730be92e5aafa265a979000000000e80000000020000200000007a54c513c183e1b2cb5e0d302c126fbcc8585b3b04fbc4cc064b902b3247530420000000a63a5e8a487113a9e649a8ff8b85943916a2195df840644f21b6a53fc3382b4f4000000018bce7b5a3e3209a7c9c9bc8de2f7465c78d7ba4721c051c8bec129a205f1385c93b701739920223c0448751bd8b0c4edf2a639b1fffe3a8873dbaef82ce6ef6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7015585704d3d801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1340 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 1340 iexplore.exe 1340 iexplore.exe 332 IEXPLORE.EXE 332 IEXPLORE.EXE 332 IEXPLORE.EXE 332 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
iexplore.exedescription pid process target process PID 1340 wrote to memory of 332 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 332 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 332 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 332 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1644 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1644 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1644 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1644 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1788 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1788 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1788 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1788 1340 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://quarrelaimless.com/9b3cd056?nphmy=56&refer=https://mixdrop.co/f/ql3ndw6eb3ndw7&kw=["mixdrop","-","watch","beast","2022","720p","amzn","webrip","800mb","x264-galaxyrg"]&key=b8ec1bba676d04d104b756970b8e0395&scrWidth=1600&scrHeight=900&tz=-7&v=22.8.v.2&ship=&sub3=invoke_new&res=13.31&dev=r&psid=mixdrop.co&adb=n1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:340994 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:406542 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5684d0bdfdc758892910917dee42a584d
SHA108a7258408ed35346505d75fac1acf384c48d0be
SHA256e5fd1ddbf370b7eaaeea7f4811a14107e4f9e4fd281ec0c41422bace8dd80f2f
SHA512477cc1de52903a9161af3c7a47deefc246e6a4c7814147764bc5bcaa8b20c4b0297d89c4341b57ca38616db26310534e30aa637fa2d667835282d01261ce63cb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\IN9OU0MD.htmFilesize
18KB
MD5838378db1a4d783e76ccf48876c80cac
SHA19abdb0f475eaabe0221b8f51b01a899d6ce370ff
SHA2563f719205ae698e4080b9dbed92e3afbfe3c690c085d8bae651b6772b2d2b9ec0
SHA512edb203de547265fd2c9ec48985efe25e290a30eb2bfafef215588732627ddd7a507f2aad6ebacd8a0b40828f954b492665b81ccb3936b1af28eae806826c78c0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8K8ISZG2.txtFilesize
603B
MD52539b9309928e255a6d96ecbc7c6e1e4
SHA1efbb38cc8a7c50494dbbf76b8ffb765bf118bba1
SHA256f55e11dd29698ac1ecd2b8c724b5475d47fe7f7823f8eb477803874ca53ee46b
SHA512c3e06b3aec26729a3195d7b305ad0cb8cb93ff374f534dedd08c55d4230fccd57cece85d337838a14d475365364d7126cb8d4f29e1efb4687f38dec2d3777fb5