Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
-
Size
461KB
-
MD5
02daa9b31021ad96f691a9224946fbaa
-
SHA1
00ef86586ced51f77e503f9b73f113bc03ca5d17
-
SHA256
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f
-
SHA512
734aec84e62c8e8db3190058844ee0e4926bde59c740f87635ec18d7b71b2e2205cfd47032c5ab866403854b05bca86239c143f31190d44fbc6ec1fffd6ae0cf
-
SSDEEP
12288:ht99YEY3GlWRLb+T/HDOt7qEwUdC9QkGLEZAzWOprRc7gt:B9AMWRfY/HESuC9QpLaAzWOt
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 516 cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371663006" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0FBD981-43FA-11ED-9ECC-C253C434FFA8} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000d51b38c2e3c18d3eb4036b70a6568978f48bfd6571d30bd2edf400f58af0e2f7000000000e8000000002000020000000ed945c5a579a30dd58522a0110c7e401a29fb1dc9b2eccefe85479fd7b00deeb200000001307d003dfb39c11794bebc3c9c233ea257033e7dd025365a02d21e1ee9afa74400000004a7d664397eb98d4cce111a42bc6357e932097bd684d161bf0092186a2da8858c537bacc84246bc998f30ec5884635ab911b1e7c31dddab6b6432904c56374c5 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806e5fc007d8d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000093d2027bd587cbb5ed770e97bdcfbd39901fe5b1c3a82ffe284a377e6bbc52b4000000000e800000000200002000000038df0a096a3debfb895ebfb2bc029a842376f5fd5ba283417a062adcf05124839000000087757525fd3e6a2cfacb2f0c41b64af30bfb0f02bfc0c48669dcbe68545dc8545ee8ebf03bf253fd05564ec63182f85421b231d13a27cb81b0a2e21cba0fbd87ec476857c391d2f2bed141009aba7879b5c12088643c4e3164fea6912c533bc5227878b1e937197e56737acf8100bd1a7e4247531563ab953c2fe0d847f7fd16e23594a046ccc78a1022013f416ce1f3400000001aefafe3ba89f3595bf1307d03ef2a0e205ee257c8c151b9deefb8e979464ac65cf7b1af751a0ed6eeb020083f23370133047946f4b177eb04dd02cd10c26706 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1332 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 676 IEXPLORE.EXE 676 IEXPLORE.EXE 676 IEXPLORE.EXE 676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1332 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 27 PID 1768 wrote to memory of 1332 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 27 PID 1768 wrote to memory of 1332 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 27 PID 1768 wrote to memory of 1332 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 27 PID 1332 wrote to memory of 676 1332 IEXPLORE.EXE 29 PID 1332 wrote to memory of 676 1332 IEXPLORE.EXE 29 PID 1332 wrote to memory of 676 1332 IEXPLORE.EXE 29 PID 1332 wrote to memory of 676 1332 IEXPLORE.EXE 29 PID 1768 wrote to memory of 516 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 30 PID 1768 wrote to memory of 516 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 30 PID 1768 wrote to memory of 516 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 30 PID 1768 wrote to memory of 516 1768 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe"C:\Users\Admin\AppData\Local\Temp\97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1332 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\97A4A7~1.EXE2⤵
- Deletes itself
PID:516
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5def67333a1ee5ac9eaa78268c4a1f982
SHA1184ec8fe8a927c128c23b09189d8b41e332e3dd9
SHA25630571ad6fcbf3415264f6306eb948f05566bdab338daaef6ed276a15c421fba8
SHA5127d60f3a69ef98bb34ba2be7914de07214ddb8f531fd7089aab0223a14fc0897a98be5e8737f2cb0268417178b2cc1973b14ccff2cecebcabde32989ecde8ee3e