Analysis
-
max time kernel
79s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 08:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://delivery.itzmychoice.com/ZURNGFOSB?id=173480=IU9UVwFSUFpSGFZSDQMBU1FcBAYGCVQGB1NdVVZRVlQAUQFTVABUAwECAwYJAVpUUltOAllZWxxeUgF2QAhcCgxcEgdCCAsMTAddW0QBVAcFDQBUAA4HBAEEXQ8AV0kMFkcUXBlOAAcODURTSklMWERDXxpWUFpbUVJKVVwOGj43YSohcC43IF0NVkpOAw==&fl=CkcQFkVbS01VUgQFCgdMQlVVUQdbFkdHHVERWFc8QRYDXRcAUxNLAxIUHF5MXQ4SUVVTDRtUUFdyRA9fXQ1aEgNHDQlYTwcNDw==
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
http://delivery.itzmychoice.com/ZURNGFOSB?id=173480=IU9UVwFSUFpSGFZSDQMBU1FcBAYGCVQGB1NdVVZRVlQAUQFTVABUAwECAwYJAVpUUltOAllZWxxeUgF2QAhcCgxcEgdCCAsMTAddW0QBVAcFDQBUAA4HBAEEXQ8AV0kMFkcUXBlOAAcODURTSklMWERDXxpWUFpbUVJKVVwOGj43YSohcC43IF0NVkpOAw==&fl=CkcQFkVbS01VUgQFCgdMQlVVUQdbFkdHHVERWFc8QRYDXRcAUxNLAxIUHF5MXQ4SUVVTDRtUUFdyRA9fXQ1aEgNHDQlYTwcNDw==
Resource
win10v2004-20220901-en
General
-
Target
http://delivery.itzmychoice.com/ZURNGFOSB?id=173480=IU9UVwFSUFpSGFZSDQMBU1FcBAYGCVQGB1NdVVZRVlQAUQFTVABUAwECAwYJAVpUUltOAllZWxxeUgF2QAhcCgxcEgdCCAsMTAddW0QBVAcFDQBUAA4HBAEEXQ8AV0kMFkcUXBlOAAcODURTSklMWERDXxpWUFpbUVJKVVwOGj43YSohcC43IF0NVkpOAw==&fl=CkcQFkVbS01VUgQFCgdMQlVVUQdbFkdHHVERWFc8QRYDXRcAUxNLAxIUHF5MXQ4SUVVTDRtUUFdyRA9fXQ1aEgNHDQlYTwcNDw==
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "285271795" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000073f7236e40874bc39aa0c193c3e548b75e2ae13f9ae03fc87b56edcb24b20688000000000e8000000002000020000000fd5bd2c5c948f2aa68886e46d80f47b316feb98efe3e3fed72b396ee68826a4020000000433d10009b243cded73f9700f1230ec56d996549be3c6affb81102123e1b7ff640000000b05b8ce07b397d15964ec6e5d4dd0704d814282465f07cb55c6ed69f5505eacf9a95d0f35487bd2d5fd6b5e5cd533121b432efbb0f2827f514216606dd2f2893 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989643" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "296677833" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cfa41f4bddd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3CA185E5-493E-11ED-A0EE-C2D2A1265889} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "285271795" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000091c6084b9df385d442216538712c85235b9e10a6f6510ed617a809bae9bad932000000000e8000000002000020000000d300b20841d300327b09c55e09110910e046a3f75b4793fe7687edff1a5f999d20000000f25806f34cea2c1281ced1a34b525a7137d2907ba730ecbda86882b6faa6f1bb40000000d9b8b12c371f8b8ac9324bb5fc4c77faacef1700c24d8217b605bb0d2b189d10b16ce776ddc98979001cdc36316f8265bc95e3b7072c1016ad189223df999d90 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e8981f4bddd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372241692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989643" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989643" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4488 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4488 iexplore.exe 4488 iexplore.exe 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4488 wrote to memory of 4872 4488 iexplore.exe IEXPLORE.EXE PID 4488 wrote to memory of 4872 4488 iexplore.exe IEXPLORE.EXE PID 4488 wrote to memory of 4872 4488 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://delivery.itzmychoice.com/ZURNGFOSB?id=173480=IU9UVwFSUFpSGFZSDQMBU1FcBAYGCVQGB1NdVVZRVlQAUQFTVABUAwECAwYJAVpUUltOAllZWxxeUgF2QAhcCgxcEgdCCAsMTAddW0QBVAcFDQBUAA4HBAEEXQ8AV0kMFkcUXBlOAAcODURTSklMWERDXxpWUFpbUVJKVVwOGj43YSohcC43IF0NVkpOAw==&fl=CkcQFkVbS01VUgQFCgdMQlVVUQdbFkdHHVERWFc8QRYDXRcAUxNLAxIUHF5MXQ4SUVVTDRtUUFdyRA9fXQ1aEgNHDQlYTwcNDw==1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4488 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86CFilesize
631B
MD538f881f3a073a20f6b215b338d664f52
SHA19da80c3ff4c1c1dbff8699923870ba26a61a9feb
SHA256cbe0e13b55fa32d0bd7899d6bbad0c69d24cb11da9d53c2ce30d0d68895d5558
SHA512353b0d1debe1e2f2ab706f9102af2da10989d58e65ace6b9641c40f909dc89f368c31aa0a4629265288aafe81c82a002e1235be83b9e32d155760d523ef950eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86CFilesize
242B
MD5d85b89b1dea6ebbe71989847632d2170
SHA1f461d271b18ddbbb49cf834c558ecf36d6565589
SHA2563a8473c77527e09ce676aa1b1f2e1d9e8a8e40b2d71e0ddee205a32212583d9d
SHA51250ba0db93f10ae657da4ec406b5bf55bac37b98d4972248edc5e805b044027cbe42f3decbe81bb5998b72b232b8f14280d52f12750d485b072fedee7e2b4c91e