Analysis
-
max time kernel
76s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 11:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ektorsot/askdakfjasd/raw/main/local.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://github.com/ektorsot/askdakfjasd/raw/main/local.exe
Resource
win10v2004-20220812-en
General
-
Target
https://github.com/ektorsot/askdakfjasd/raw/main/local.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
local.exelocal.exepid process 284 local.exe 872 local.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI2842\python310.dll upx \Users\Admin\AppData\Local\Temp\_MEI2842\python310.dll upx behavioral1/memory/872-64-0x000007FEF5DF0000-0x000007FEF6254000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
iexplore.exelocal.exepid process 1784 iexplore.exe 872 local.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Detects Pyinstaller 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe.fuj2aa0.partial pyinstaller \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe pyinstaller C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe pyinstaller C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe pyinstaller -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 80622e893ad3d801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1224441-3F2D-11ED-8538-4A4A572A2DE9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371135102" iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1784 iexplore.exe 1784 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1784 iexplore.exe 1784 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
iexplore.exelocal.exedescription pid process target process PID 1784 wrote to memory of 2028 1784 iexplore.exe IEXPLORE.EXE PID 1784 wrote to memory of 2028 1784 iexplore.exe IEXPLORE.EXE PID 1784 wrote to memory of 2028 1784 iexplore.exe IEXPLORE.EXE PID 1784 wrote to memory of 2028 1784 iexplore.exe IEXPLORE.EXE PID 1784 wrote to memory of 284 1784 iexplore.exe local.exe PID 1784 wrote to memory of 284 1784 iexplore.exe local.exe PID 1784 wrote to memory of 284 1784 iexplore.exe local.exe PID 284 wrote to memory of 872 284 local.exe local.exe PID 284 wrote to memory of 872 284 local.exe local.exe PID 284 wrote to memory of 872 284 local.exe local.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/ektorsot/askdakfjasd/raw/main/local.exe1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5462a2730ed669d352868bcf29584d7ce
SHA1ab9e4b9cb2c87255ca2de23e431da9e2e52542c6
SHA2568a629abc78b74fdc8df2a2f3a4cd9e4246d2b1b60b2de076386f1efebf4a29bf
SHA5120cad40a42870618f48787db6d479004ba8fe82516470fdedf8d03ed6fb82bc1fbf3820197a257645d530dd96f12114b882dbd1a909a62fda3733e2b89d5f1168
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exeFilesize
17.3MB
MD5e548a371d9b92e8cf5a9dbd266ac4785
SHA1b1996841c38023c4f9ab80da44ce106b094b3ee2
SHA256edc3990f21d60d2980d3146f3d67355ebb15326a5db6666fb2e82a711579974b
SHA5126f59ae5b8e483ea49dc872711d6078bc7745b28338901a9b626a7656fa7fa2d5fc27e759ce2aa6e1a8ba9b33e4eecbfeb3633429d6757128dd0ae42dfb625316
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exeFilesize
17.3MB
MD5e548a371d9b92e8cf5a9dbd266ac4785
SHA1b1996841c38023c4f9ab80da44ce106b094b3ee2
SHA256edc3990f21d60d2980d3146f3d67355ebb15326a5db6666fb2e82a711579974b
SHA5126f59ae5b8e483ea49dc872711d6078bc7745b28338901a9b626a7656fa7fa2d5fc27e759ce2aa6e1a8ba9b33e4eecbfeb3633429d6757128dd0ae42dfb625316
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exe.fuj2aa0.partialFilesize
17.3MB
MD5e548a371d9b92e8cf5a9dbd266ac4785
SHA1b1996841c38023c4f9ab80da44ce106b094b3ee2
SHA256edc3990f21d60d2980d3146f3d67355ebb15326a5db6666fb2e82a711579974b
SHA5126f59ae5b8e483ea49dc872711d6078bc7745b28338901a9b626a7656fa7fa2d5fc27e759ce2aa6e1a8ba9b33e4eecbfeb3633429d6757128dd0ae42dfb625316
-
C:\Users\Admin\AppData\Local\Temp\_MEI2842\python310.dllFilesize
1.4MB
MD599cb804abc9a8f4cb8d08d77e515dcb7
SHA10d833cb729f3d5c845491b61b47018c82065f4ad
SHA2568d23914f6eaa371f2e0c15816c7ab62573d428e750d1bbcd9a07498264d7d240
SHA51243252d45803957ba79d42afdd12b956c3b829c9b00a78199c35e3eeb863d8c56f4f0b467faae227b7c058f59a3f11152f670090e2212eb6a2837378bca53ac82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\E8TAY3AU.txtFilesize
608B
MD52eb7444aa5b0bc6913d9bcb7325d0162
SHA166726441d9ba2e1a79dca8651023ddddc5334940
SHA25602c35c2c2bf2fa875f5047a73e92be7e8511b1a2889620cc5266d1e54a4fd214
SHA5127d12245d22c1258bda8e4b4bf87dd7ba9b678261cb3b4c0975741272245e70691785d7c4b8a677dc9308398cecaa1dbee558655e31d51c0e17a8fa21884ccdd5
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I9NA5QYV\local.exeFilesize
17.3MB
MD5e548a371d9b92e8cf5a9dbd266ac4785
SHA1b1996841c38023c4f9ab80da44ce106b094b3ee2
SHA256edc3990f21d60d2980d3146f3d67355ebb15326a5db6666fb2e82a711579974b
SHA5126f59ae5b8e483ea49dc872711d6078bc7745b28338901a9b626a7656fa7fa2d5fc27e759ce2aa6e1a8ba9b33e4eecbfeb3633429d6757128dd0ae42dfb625316
-
\Users\Admin\AppData\Local\Temp\_MEI2842\python310.dllFilesize
1.4MB
MD599cb804abc9a8f4cb8d08d77e515dcb7
SHA10d833cb729f3d5c845491b61b47018c82065f4ad
SHA2568d23914f6eaa371f2e0c15816c7ab62573d428e750d1bbcd9a07498264d7d240
SHA51243252d45803957ba79d42afdd12b956c3b829c9b00a78199c35e3eeb863d8c56f4f0b467faae227b7c058f59a3f11152f670090e2212eb6a2837378bca53ac82
-
memory/284-56-0x0000000000000000-mapping.dmp
-
memory/284-58-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmpFilesize
8KB
-
memory/872-59-0x0000000000000000-mapping.dmp
-
memory/872-64-0x000007FEF5DF0000-0x000007FEF6254000-memory.dmpFilesize
4.4MB