Overview
overview
7Static
static
FinanceEYEfeeder.zip
windows7-x64
1FinanceEYEfeeder.zip
windows10-2004-x64
1LICENSE
windows7-x64
1LICENSE
windows10-2004-x64
1README.md
windows7-x64
3README.md
windows10-2004-x64
3ThankYou.html
windows7-x64
1ThankYou.html
windows10-2004-x64
1assets/icon.png
windows7-x64
3assets/icon.png
windows10-2004-x64
3background.html
windows7-x64
1background.html
windows10-2004-x64
1background.js
windows7-x64
1background.js
windows10-2004-x64
1content.js
windows7-x64
1content.js
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3style.css
windows7-x64
3style.css
windows10-2004-x64
7Analysis
-
max time kernel
154s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
FinanceEYEfeeder.zip
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
FinanceEYEfeeder.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
LICENSE
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
LICENSE
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
README.md
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
README.md
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
ThankYou.html
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
ThankYou.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
assets/icon.png
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
assets/icon.png
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
background.html
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
background.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
background.js
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
background.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
content.js
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
content.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
manifest.json
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
manifest.json
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
style.css
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
style.css
Resource
win10v2004-20220901-en
General
-
Target
ThankYou.html
-
Size
1KB
-
MD5
fadb27169285f9afc664aaacbeeb5fd2
-
SHA1
2ca38b2a3cbe5388ff2aae840d6875bd5b6ce233
-
SHA256
72cacf2eb02d9b220556df1ba0f776f79b8b1cb7bdb54fbc508651ec754ca0e4
-
SHA512
56b2f4155fbff51aae20ba4b669378d96a4ee38920bc47046fcb1189cdae9640fb5b4668eb0af7f60c548f343bceacf41f12b0545f711ddecf7ccc99ef590cf2
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E99EF13-50CF-11ED-89AC-FE977829BE37}.dat = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7E99EF11-50CF-11ED-89AC-FE977829BE37} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
iexplore.exepid process 2068 iexplore.exe 2068 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2068 wrote to memory of 1180 2068 iexplore.exe IEXPLORE.EXE PID 2068 wrote to memory of 1180 2068 iexplore.exe IEXPLORE.EXE PID 2068 wrote to memory of 1180 2068 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ThankYou.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:17410 /prefetch:22⤵PID:1180