Analysis
-
max time kernel
104s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 14:08
Static task
static1
Behavioral task
behavioral1
Sample
9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe
-
Size
467KB
-
MD5
769eaae3928abba5ed98c3f6999f721c
-
SHA1
a4193270b916d489e90ebcfa467f947295a6dfbb
-
SHA256
9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e
-
SHA512
3ce51b24e603d95f23f80d02ccdb7720e47260cbc2f8c288637df92aa354d909f87d26f452c0aff8e86788689e67c65f798c290f04fa2e4e9e8e00d8e63a1ca2
-
SSDEEP
12288:GMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0U6:FplNFgxG5eZngb01
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372357463" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000000011df28bd6c8641836f686d173d2db2acbb47d1ae420e8b833d463386250553000000000e8000000002000020000000687014070e656879cbd144055887f43fff1e89e4f5038b79295a56d88daaf23f20000000abd7d50f70cd49a868da0c5097aa00630a614cf844126e2fea47dd55e3139130400000004b09dbd219b13a44decb12cf259d4825a276b0cfe34474c5619cd30a0ac80deac55ec01518858b3d57e666eb2417cd1941f1a859a1ed07520ff766f36ca4f807 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0540eaf58ded801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000004b85f733e2480097e05361e74e528f27b150e3d012d8a2acb794656d6017a3000000000e8000000002000020000000aa51f2fe208cecb28c6163c25ee0a044584739c27c1b1fe86eb268ff1137e560900000005859adb62985e083fad9b05fe0ac0aecd91a15e96227bbb94dc995ea6125f916581886761d352038e714cf03a4e886f7c284b00506673ff85d2ff29fed45a5f89c367d4c09fc55035b5df94727a8019e29a72877a81faec7fb5f3a018e2ba509a122abd6b967ef6c529861e74c25a7aa6dc8c58aac19dc6aeb5dcc405f715b66b9b4aaf46e02ed04bd1e37077c0b3cbd40000000fd8c82cce35afa9f56e159e20719a9981742b5e61fddefae03ac0a11ec21d164e0a69045cb5615860a6b7c791615d6121a64c34299688a1006beb0dabe438b29 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B820EE91-4A4B-11ED-9551-6E705F4A26E5} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 964 wrote to memory of 1724 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 28 PID 964 wrote to memory of 1724 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 28 PID 964 wrote to memory of 1724 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 28 PID 964 wrote to memory of 1724 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 28 PID 1724 wrote to memory of 1708 1724 IEXPLORE.EXE 30 PID 1724 wrote to memory of 1708 1724 IEXPLORE.EXE 30 PID 1724 wrote to memory of 1708 1724 IEXPLORE.EXE 30 PID 1724 wrote to memory of 1708 1724 IEXPLORE.EXE 30 PID 964 wrote to memory of 1856 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 31 PID 964 wrote to memory of 1856 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 31 PID 964 wrote to memory of 1856 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 31 PID 964 wrote to memory of 1856 964 9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe"C:\Users\Admin\AppData\Local\Temp\9297f766c167cbfbcf195a07e40673bad81a9f20a8b5fa001617569f32500e6e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl32⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\9297F7~1.EXE2⤵PID:1856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5aa01e1c983262bfb746a2fdb18e478c7
SHA1b02b977656125c6bd7944e8e60ee032c78435af8
SHA256af6028ad1d560673227f846656ca83d81db8ce8033acd98c849fba0f84684c5e
SHA51254a36a9fb945da500046c66945986b9ea1c03eb4324decb8d163e27ee5ae61f346bc559898f6055baca38699fcc1e9e056ef4dcd47fe0e2a232f564d2a71a113