Analysis
-
max time kernel
122s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe
-
Size
461KB
-
MD5
02daa9b31021ad96f691a9224946fbaa
-
SHA1
00ef86586ced51f77e503f9b73f113bc03ca5d17
-
SHA256
97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f
-
SHA512
734aec84e62c8e8db3190058844ee0e4926bde59c740f87635ec18d7b71b2e2205cfd47032c5ab866403854b05bca86239c143f31190d44fbc6ec1fffd6ae0cf
-
SSDEEP
12288:ht99YEY3GlWRLb+T/HDOt7qEwUdC9QkGLEZAzWOprRc7gt:B9AMWRfY/HESuC9QpLaAzWOt
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2031279348" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000009ec2ce9625b7823c853f981b54c9d1749799447809173a25f0fc56748b8d42a1000000000e80000000020000200000002352f4d4da6c7d0bfd963c7b470ae58662ddc57cb1d2925ee3e261fcabc13bc620000000d2e9a40b8f877ff3a699fd773fe63aa2778592d4d7987307715f8a8533785eed40000000f1c5a7be015f60cf458b16d7a6d2ce07e90449eacd348286ad68cabb5843f8dc26a93460ee2ed24bd8d5da133f15607da2ebe80ab6282c9f8dd628877c56982e IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0065c28a18d8d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371670208" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A0C98546-440B-11ED-B696-5E3721E937B7} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988312" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000fc127342cdf9e4e80006126d7776a1fd6e3ca5c19fee37806adb8727da749803000000000e800000000200002000000087737cca0fd528d30b4078d5c068ee5e56770b5acfc59b075ecb35b2721f1f9020000000916b324816def1e3a14171060ae884e33690a026f984ace8951424a1b50c9af140000000d3c4d18068ac5066db3fa3e0e408e99889b99cfa98b5462839364f232df5f4d94470cd6d02904c2c098685d3618f397096e119d750884559eb0b481738eef66c IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c094a68918d8d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988312" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2031279348" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 508 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 508 IEXPLORE.EXE 508 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5092 wrote to memory of 508 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 82 PID 5092 wrote to memory of 508 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 82 PID 508 wrote to memory of 4724 508 IEXPLORE.EXE 83 PID 508 wrote to memory of 4724 508 IEXPLORE.EXE 83 PID 508 wrote to memory of 4724 508 IEXPLORE.EXE 83 PID 5092 wrote to memory of 4688 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 84 PID 5092 wrote to memory of 4688 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 84 PID 5092 wrote to memory of 4688 5092 97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe"C:\Users\Admin\AppData\Local\Temp\97a4a7073e71c8c6ca1edd940eb7d124b04ce7f1c5a015cf766ba8acf0fea88f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:508 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\97A4A7~1.EXE2⤵PID:4688
-