Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe
-
Size
449KB
-
MD5
9057c09972e880e77c66d09067ac7847
-
SHA1
dc198f1f211c2c3698df95ce83dfbc070598590e
-
SHA256
29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea
-
SHA512
bbf637931198bbd9b2f44e8dbbef94d772a7733d4e1f9c86de830a64ded5ca20e77744092ffe1698499e452a5f48ac116720bb74d964ea8f433d3da3f5f8f2f6
-
SSDEEP
12288:q0+GxSV74cwpgpJq3m6qkdKEFOwrv7m+ed/f05wCDPSdptRlJFz:pxe8c8gp43NdZLref05wrfRlb
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000023f342bd5b382da30f092edbc0400407cec199aa67674d694f265009c2286b19000000000e8000000002000020000000178f58608bee58fac25bd264c01a5fb7327a59bd491b99262d6a73730015861120000000ac03f7c234175d5c70c8d8da534eba0ce7d85ad1939a464aa54d00c60200f9cd40000000180acd0a0afb0bb235e06cbc53a19646d57a4ac0e6bc13d3aeb63f0028b623e39a08734c33c4aaec087a98772e882684e308b8705050ecaeb10a80a39856eb4a IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bd0dcaa3e4d801 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991523" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3360212036" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3360212036" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3372712280" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991523" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991523" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000002503f1c0ddfc9b382b5be47d641d24658be2778bd39a555e91c06a438600dff2000000000e8000000002000020000000b83146ab2af6a85bc16225bbb5044d4a42e652a53f163159363e9066a27e022720000000937db17d0597d4d2828db3b7037ab2139e2ca796c3aeb6ff81d0ee2a0e138f7140000000692c713439c26c1c7c71d08728a00db3feb3474c5b1490efc750da63c5eaeb4a3432df237261f3047e6b1520c95316f3bcae0ddca54df966abfefad29f29edba IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3027e5c9a3e4d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373049463" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F33AB5B4-5096-11ED-B696-E23A5D90AA50} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3436 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 3436 IEXPLORE.EXE 3436 IEXPLORE.EXE 5112 IEXPLORE.EXE 5112 IEXPLORE.EXE 5112 IEXPLORE.EXE 5112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5116 wrote to memory of 3436 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 84 PID 5116 wrote to memory of 3436 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 84 PID 3436 wrote to memory of 5112 3436 IEXPLORE.EXE 85 PID 3436 wrote to memory of 5112 3436 IEXPLORE.EXE 85 PID 3436 wrote to memory of 5112 3436 IEXPLORE.EXE 85 PID 5116 wrote to memory of 532 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 86 PID 5116 wrote to memory of 532 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 86 PID 5116 wrote to memory of 532 5116 29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe"C:\Users\Admin\AppData\Local\Temp\29ffd7a0b4ecd782d8944688219030fccdc8bba8c5a8115e68d82fc95f9df4ea.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3436 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\29FFD7~1.EXE2⤵PID:532
-