Analysis
-
max time kernel
106s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 07:22
Static task
static1
Behavioral task
behavioral1
Sample
191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe
Resource
win10v2004-20220901-en
General
-
Target
191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe
-
Size
24KB
-
MD5
74bad72d284efa2b4ce6201bb87c8115
-
SHA1
214c289fb85246306f32c9358591d0dfd44a788a
-
SHA256
191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229
-
SHA512
25f8c80c2032638ca7df2fdd065f1aa86990f57357dca2e6328889cc7e48eeae9f330e9591f8e208e2f6fb52e2efd6e7f7da3054c17e4596677345f1cf84fbe2
-
SSDEEP
384:IWTNDn9nN7aCY8CtBcelBcowXVN2+CLcrfiyjHjKhGOB:IWTdNHfiyjDK7B
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000e7999e181de67cdcc8137036d16dbd5c9eb8e033371b2204bcfd0bfb4f92c82a000000000e8000000002000020000000c33e472f64f008da161fdb62a419f65b0dfe3a85b44c92e95a5f776559c4426920000000a230ff7cd15656f55d823bcffc529ac6ed1cde63bb41a6445c000917552fd7dd400000009f9a6d75f416e36b306c6cb725e3f082b16cc22d17e0a6549d77c8a6faa77c93729fa08697480977f19d2567549db7352d9cf7eeb3e064e2180fefb4ded58492 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6031c7863dd6d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000563132e55beb76f82273b22f2af73b85fc54337e43bd6ba6488e896cd87df468000000000e8000000002000020000000631f538ad215b3b20dde7e947973efd0e997dffe03b902830265a90a9711e4b290000000e2b07a0c783c5b690612f3ffc99cbd65718d1bbd600f1473e480b68b6a3d0ee2f92fcbc9304da923647b9444c941206b042409daea83a4ce2e6963e59a4e052b4b4ed8945ec9b34d3be6dd49f93e6a3d7ff1d7ccce57ced53df576139b2f0a0ad14ac0d65a59c62a4c84fd555c4a30ef448d9417f22d11f6569998f7259ff2bfd40601128d5793377c58a96cc73f65c7400000002fdee4402aa1c91f916924ff6d4a16640a3f2c7f7eaa0592d3c4fd49ce33cde29d7672d410edd1f25f6fd5de6ee313c47eae514d02983d3a5c1880f838f7fed7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371466209" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACB6BD51-4230-11ED-979A-4A7553B9BC92} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2012 iexplore.exe 2012 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exeiexplore.exedescription pid process target process PID 1716 wrote to memory of 2012 1716 191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe iexplore.exe PID 1716 wrote to memory of 2012 1716 191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe iexplore.exe PID 1716 wrote to memory of 2012 1716 191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe iexplore.exe PID 1716 wrote to memory of 2012 1716 191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe iexplore.exe PID 2012 wrote to memory of 1756 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1756 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1756 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1756 2012 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe"C:\Users\Admin\AppData\Local\Temp\191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=191dc583eef0d531dc9631254dad3de70269529020a82f5c18f358b0071bb229.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PJ27SZC7.txtFilesize
603B
MD558eeb9c1edfcccea0cb2e9df315046e0
SHA1123b310860ee77bcdd2a758979ae60fd39b1f88e
SHA256b4055249881156ed7d26228160e43e9e502052271b238e60ff5f1c3c7a544f75
SHA512544b76036b23304f57952cd520a53188301697d7715445c738ec9b178820859121c50f028cc4b5e867433911b9f5d8ecdd4956f24b84fcb538d2e766da50aea7
-
memory/1716-54-0x00000000765B1000-0x00000000765B3000-memory.dmpFilesize
8KB