Analysis
-
max time kernel
112s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe
-
Size
448KB
-
MD5
a1b70a0aef83742660f05d7c6768c8d5
-
SHA1
840d00efb03c666dbaf3acaaf5a64b900fbaaac3
-
SHA256
4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb
-
SHA512
237a5240d489c1130e6f48220b106d469f7b7bcdb02a015b493507dc454c5659d111ecd22b326887d78d3aae7a7a61873d89758a4289dca2c03ea3ba21daefe7
-
SSDEEP
12288:L2zYwl6KIgsdFOI3BM1HGwQLOV0J9rFlc5Mt24NJMq:LeYPfu1HXIGirFlMMNJh
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1184 cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8594721-4FC3-11ED-8716-EAF6071D98F9} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d57acad0e3d801 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000c53da1a2f05d3d7fb0972d9ef1d7a77fc2395c94da153faab9e8719203283940000000000e800000000200002000000035f411508be9c44505a5f40c91460913ae45ce0a38faca19d7c2d4ed4405541c90000000869bd6d9dd396e9798184c05f78fc79704479b08f65d73a4e15af19c5ff60e895efb74a43bdfc3727d892c32bfc7b0bdd1e5d2351c2c7a3f49685e571f858a59b363c6d563f7eebcdefa6e9c729754b3cb56bc44abc7f7905b7f7ad087ff835851b2340b3a2ea072d4cb5cea39b05ba9dcc48ca9fbc1c3de243dc75dc4c521b2a92171120d4d673b8b758bfebe9d79c140000000c4b6fa4e5b9139915499a456ae8b453fa4de3b4f20453c6a2643395bcb3e776ef1d369233d756363addb88b636ac939c9c3722db78d9bf7a1945ffb891f9a429 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000005b83e0320309cbc8c555dca46eeb89a67c03681c0efb060a99b1524dc8d10246000000000e8000000002000020000000b0c381ebc011a2f3fb5d7eb68570b50c09190a82000f6b61fc9305e44cb7a1732000000085beaecc9241b7927ae2dc4099fc7341db926ad95c16cff814785f552dee2f0d40000000ecf84178a2f5098379297a9ee8cdd2a50d6143dbaee9ea5a6cfdd154592629a9e9b5db56d8436f96899548816d2cd88949c541f7aeb7ab22c87085c6a9df3342 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372958797" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1492 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 1492 IEXPLORE.EXE 1492 IEXPLORE.EXE 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 748 wrote to memory of 1492 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 28 PID 748 wrote to memory of 1492 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 28 PID 748 wrote to memory of 1492 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 28 PID 748 wrote to memory of 1492 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 28 PID 1492 wrote to memory of 1228 1492 IEXPLORE.EXE 30 PID 1492 wrote to memory of 1228 1492 IEXPLORE.EXE 30 PID 1492 wrote to memory of 1228 1492 IEXPLORE.EXE 30 PID 1492 wrote to memory of 1228 1492 IEXPLORE.EXE 30 PID 748 wrote to memory of 1184 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 31 PID 748 wrote to memory of 1184 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 31 PID 748 wrote to memory of 1184 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 31 PID 748 wrote to memory of 1184 748 4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe"C:\Users\Admin\AppData\Local\Temp\4913e085893fe118d236986919a833882fc813c5008ca60207d12ffb7ed972fb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4913E0~1.EXE2⤵
- Deletes itself
PID:1184
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD569f246902f0e7eb650212b43b70600e3
SHA1147ac1bf661fa988d6a57c1b9579b9a1d0761f11
SHA2567aff48f70b5cedd9483d204d911aa6c2a126c5da32006044cdf42a215fabdb53
SHA51240452a48ea5236fb23182fa59d6d4ba4d394dc2a064aebb5b946dcff9a352c4259203d2c5f0942010f2c8773df7007af8f48859876cf4909f777b79ac7eb2a5e