Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe
-
Size
301KB
-
MD5
6fb13beb5e6fe17b4ce6a81d94aba340
-
SHA1
e36707e0d178584ab5d665b5814bb4fc476d1962
-
SHA256
56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0
-
SHA512
6b5598873da3a9b13c853f4449478cd596b184452c13d35c04c8915dc2ef274e8fab29526f31c3496fee91f10d93f6666ed69628aaad7d51bf892f99e19ecdd3
-
SSDEEP
3072:bywG4ZQeAnuTCt2xbzmyoaq6rcYsc8kOeAVlDZS+qP103Y1T6gX4I93frop0Gw/M:gnjZ2xPX42o+nFW0uG7MZEkoy
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 812 set thread context of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 set thread context of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F63A0ADB-4279-11ED-A0EE-DE60447A8195} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987910" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371497686" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987910" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987910" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3402063589" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3402063589" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3415500949" IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4656 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4656 iexplore.exe 4656 iexplore.exe 3448 IEXPLORE.EXE 3448 IEXPLORE.EXE 3448 IEXPLORE.EXE 3448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 812 wrote to memory of 1636 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 84 PID 812 wrote to memory of 1636 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 84 PID 812 wrote to memory of 1636 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 84 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 812 wrote to memory of 4656 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 85 PID 1636 wrote to memory of 1552 1636 cmd.exe 87 PID 1636 wrote to memory of 1552 1636 cmd.exe 87 PID 1636 wrote to memory of 1552 1636 cmd.exe 87 PID 1552 wrote to memory of 1788 1552 net.exe 88 PID 1552 wrote to memory of 1788 1552 net.exe 88 PID 1552 wrote to memory of 1788 1552 net.exe 88 PID 4656 wrote to memory of 3448 4656 iexplore.exe 89 PID 4656 wrote to memory of 3448 4656 iexplore.exe 89 PID 4656 wrote to memory of 3448 4656 iexplore.exe 89 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90 PID 812 wrote to memory of 2896 812 56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe"C:\Users\Admin\AppData\Local\Temp\56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1788
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4656 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
-
C:\Users\Admin\AppData\Local\Temp\56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exeC:\Users\Admin\AppData\Local\Temp\56509692690ecd18b5063fa2c621d127a67bd382849e7229455971c310ef1ca0.exe2⤵PID:2896
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5cf0f2e42fd0803a0b69fb515ea1cac76
SHA14d1073cdea4eae071a0d901642e683b214fe00c5
SHA2562356c8aec3a220bc46a3c5b837a21f8ce7e3f6656c40d38c59a398c24b9e670a
SHA512fcbeb3f5b26d51f2cd48c89e4fb1317a627f21f547da51d6afa4b7b36bd634084aee7f2eef43246c7b1acb95f1973f733b78d3df12edbc4cc38fc02fd8fadae3