Overview
overview
7Static
static
FinanceEYEfeeder.zip
windows7-x64
1FinanceEYEfeeder.zip
windows10-2004-x64
1LICENSE
windows7-x64
1LICENSE
windows10-2004-x64
1README.md
windows7-x64
3README.md
windows10-2004-x64
3ThankYou.html
windows7-x64
1ThankYou.html
windows10-2004-x64
1assets/icon.png
windows7-x64
3assets/icon.png
windows10-2004-x64
3background.html
windows7-x64
1background.html
windows10-2004-x64
1background.js
windows7-x64
1background.js
windows10-2004-x64
1content.js
windows7-x64
1content.js
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3style.css
windows7-x64
3style.css
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
FinanceEYEfeeder.zip
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
FinanceEYEfeeder.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
LICENSE
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
LICENSE
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
README.md
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
README.md
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
ThankYou.html
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
ThankYou.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
assets/icon.png
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
assets/icon.png
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
background.html
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
background.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
background.js
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
background.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
content.js
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
content.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
manifest.json
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
manifest.json
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
style.css
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
style.css
Resource
win10v2004-20220901-en
General
-
Target
background.html
-
Size
1KB
-
MD5
a4dbbaf15d80ed2e69e1325906590832
-
SHA1
544076c4d966b869eff509986fd312c2b8aa7567
-
SHA256
918edbe92299b292788d69b9ebbd516f9e33bc2dcbac5b2b561e2864bbe76582
-
SHA512
adcd96b596e03ecd86cdab447e02349410cca805dab9f9db6171fa3e9205242f86e864c8b1480649cd23c1f2edb1810d68ede32cd2882fc3f65cae21730d3713
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000006fbac8b0c74d526cf58adfe0903737b080647baf73373a62dd115d924e1e7143000000000e800000000200002000000057f5962ebc809108f84c566f20bc451c02e24628b7a56a19f8192a0ee9abff8220000000ac885a5cf5249bdef5120dca26cf111e0705d22098fa2b3e9e12502228ecb8cb400000000eb7f96e517baa7be4099dabc4a7a5a2823a0d27b43f5e1740fe486982c5ff2c22bfc0b50bf0d82b1975af51a4e1486044287b035e813bed7587cfb7d3c36546 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d7614fdce4d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000bca5f6f1462e3c17164fb6c69b1c2407d52dd6031279cb33777573dcd6712f28000000000e8000000002000020000000b135f4c9115552a6fea5b1b05d9a9f9127729d16e0753f65a9357648c15e359390000000311baeb920eaa28a99b9d283ff466c0e7bc8b83fbce5ee00b11501d12b5fe03acd314182ce145e078ac0c04ade1572e227c02babd9a715851e04c876fdb0bbda38a1f9c6a6ba2f5dbce8513f76918ab194920afa6133561ffa2519442a0bf9502d4f91f16ca2d3b7c700968f56e7bac6861f35c029f1d78003da9b0381d9e6376473a746606ec6c1e85d9e297767fda740000000bb63a538d39fec84986787475204dbc5952b806089b2a706f80468b977f2593c54facb5d9428acd7b730e7d7de066bab01263f199f440a8436db2b2fd840c7c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69D2FA01-50CF-11ED-AF38-FE72C9E2D9C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373073708" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2020 iexplore.exe 2020 iexplore.exe 768 IEXPLORE.EXE 768 IEXPLORE.EXE 768 IEXPLORE.EXE 768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2020 wrote to memory of 768 2020 iexplore.exe IEXPLORE.EXE PID 2020 wrote to memory of 768 2020 iexplore.exe IEXPLORE.EXE PID 2020 wrote to memory of 768 2020 iexplore.exe IEXPLORE.EXE PID 2020 wrote to memory of 768 2020 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\background.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XE7CG5QF.txtFilesize
601B
MD53f131b51ffc2aea72561c68bf44cab22
SHA1bd411f3cc630d0cd2c95aed2295ac2527f0ac794
SHA25679ab8f0587fde65a42f74ed1a4d6c29b2bb50742f37d0be96c7bf156dbd9533b
SHA5126c170d3d2adf4792c615b737dbca5be245275fd7d9e26aea7cea165be1712409937ba2d73ba4d6c5650b9cec65cf42228faa0a0427b29f3e2d8d70d6a916e7e7