Analysis
-
max time kernel
155s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 10:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.bicdata.com.br
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://www.bicdata.com.br
Resource
win10v2004-20220812-en
General
-
Target
http://www.bicdata.com.br
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9059F81-59D9-11ED-9172-7ADD0904B6AC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b6d9d7e6edd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000001751453d0583cd0ae1e8ebe11f905f120e2a18bee7e68e4b47b3e0cdd49fa1e000000000e800000000200002000000063a7836b6d48067244d8bb3f3ab9670cb0cc697e510036370e538a6b58abb1ef20000000295d4540cea8be29e61a480f1049121aba1e018a5d83125e03956c65e4e96f12400000003ff7a249178a591018a1158a7be4dae461cca6f30b0ea01722982eae1a2e0fec1497d7de24b3ed660809dc77328af1587a7a5a61f66e50a5b1a8496bf1ac51ef iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374067800" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000004423a5cd28c9c2574c8b75eba6b59540e4c4e80ee81297782b42f76224c100f2000000000e80000000020000200000009003b19e8ae88606314e0b5960cc14b4aefd62ca27f3c0d022e8bae1a649aaee900000001f13fb6374955850c669a4ee933f13a41469568549c872f15c950e8e9229cc61f612da8f8661db8c406b680ec6e85aa81b2c54ad8fd8380b11df0424d9f1d71adb106cdba52c50cdbeb6834215ebcab6bdaf49cf7e74848f35dda1a9eed616819cff1e45403fb7aba2b28cab74b252f7b32a68af45ec95f4ce746caa6c38939c28bd920d3cb52dc9b9196f6adf2897c140000000c1acc46fc0c31191d0216231114b2d4ffd3b2d0b9cef77baa761fb3420ff0d9b1a9202d4136ae28669583d9d2fdf425ce41134614f75603ff1f66ae8962b842a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 872 iexplore.exe 872 iexplore.exe 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 872 wrote to memory of 852 872 iexplore.exe 29 PID 872 wrote to memory of 852 872 iexplore.exe 29 PID 872 wrote to memory of 852 872 iexplore.exe 29 PID 872 wrote to memory of 852 872 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.bicdata.com.br1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:852
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD551b837e384a238359ad1cec3d605cd24
SHA1bdd7fce845f4db8f9412034217557c6c8f2c1599
SHA25620e19488307973f46cb9f529204b9b6b889877e2f41a0ee1cdc91c14cb042fbf
SHA512464543d3b86d787fe84ca182faedb06189db1b8728e10de9c10763757c011318b28d9c535f1f5bee64f7514a729f4d926cd21643eaa396d78e02c1781934946e
-
Filesize
6KB
MD5f947034b1551c01934a8f4d93ee5772e
SHA14d4b19086c34adab19d312e50a9e200fd13c41b2
SHA2568ae9c56a2701d75e81e91722dc3081c4de30526e7138d577aa11954896eb290c
SHA5122ba5f9b060a6d08cfc9f4ce468a1eefd40fa23b20dbc7f3caf344256ce582d70063b0d8a8c9f263dabe555a975393e8dec134d70010e42b2853679ccbb7abd3b
-
Filesize
603B
MD504c61d00866da8b0fe01c6efcb13eade
SHA16ae93c013606c7f7d148598cf9679acd3360d19d
SHA256879599789d0866c97c5005deffd6536b1a1f9361f02750aafcd56f4231a51028
SHA512d201267a9f7584d52b094b146dd95ee718c1be0e34fd90c37c385a974e981a35b5fcc94ce5dc0bedbc0570a46301f902b8bc54b4ddd03701f986dc0e2c285929