Analysis
-
max time kernel
152s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe
-
Size
200KB
-
MD5
0cd7fa562353d6a5c30d3a3fcc459337
-
SHA1
c1085fc0b00b04e5f0aeef7e76609e63ad6685bc
-
SHA256
2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca
-
SHA512
196eb2275783066a97bfe6daec8028a0b84f804e83a3a2f656a8f1e1f2a884a71be0f639dd96e72c03adc3dc2ec9c4063defe12b19372f0b022eae0097ab240b
-
SSDEEP
3072:XlZ7bXfqPSbvsHudBEFxrec46CyB03CnPGCOMriY6iyEIsUyvEreq:o4vsOQFxreJS0KtOeiXiylsUyvEr
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 796 set thread context of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 set thread context of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373754226" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DD42A615-56FF-11ED-B696-7ED4F7B3352B} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4236 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe Token: SeDebugPrivilege 2484 svchost.exe Token: SeDebugPrivilege 1112 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4236 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 2484 svchost.exe 4236 IEXPLORE.EXE 4236 IEXPLORE.EXE 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 2484 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 796 wrote to memory of 4196 796 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 82 PID 4196 wrote to memory of 4156 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 83 PID 4196 wrote to memory of 4156 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 83 PID 4196 wrote to memory of 4156 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 83 PID 4156 wrote to memory of 4236 4156 iexplore.exe 84 PID 4156 wrote to memory of 4236 4156 iexplore.exe 84 PID 4236 wrote to memory of 1112 4236 IEXPLORE.EXE 85 PID 4236 wrote to memory of 1112 4236 IEXPLORE.EXE 85 PID 4236 wrote to memory of 1112 4236 IEXPLORE.EXE 85 PID 4196 wrote to memory of 2484 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 4196 wrote to memory of 2484 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 81 PID 4196 wrote to memory of 1112 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 85 PID 4196 wrote to memory of 1112 4196 2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe"C:\Users\Admin\AppData\Local\Temp\2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe"C:\Users\Admin\AppData\Local\Temp\2a3fb070164e37a5f10f49f01107b9bd69824b4e355ae11f5eedf9f21b0a33ca.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4236 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
-
-