Analysis
-
max time kernel
22s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 09:06
Static task
static1
Behavioral task
behavioral1
Sample
43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe
-
Size
1.1MB
-
MD5
29d2935f8308f9ee4acf995ee15a3cc0
-
SHA1
fc4903da2cdbf0316d6c3af0820fddb4c4480fd0
-
SHA256
43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db
-
SHA512
3b1c4c8f9dbc14034f899391021f8721465ff0ac494005b5abb084a3ec56e48616f703c353879fba604bfa2fc5fc892378f07f58e9ca0c9bcd168532bcdd4c57
-
SSDEEP
24576:Okljc4Q25VXX1zOpJvmEKiPLDBR60rzrRu:jQ4B5PzOpRRXDDB/P9u
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\CheckedValue = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\DefaultValue = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "10" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\UncheckedValue = "no" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMG\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "10" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "9000" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\UncheckedValue = "no" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\DefaultValue = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe = "1" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\CheckedValue = "yes" 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe 1808 43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe"C:\Users\Admin\AppData\Local\Temp\43044e7bc50e9d8760fb00ede6e81ce57a7f1f16d5970d3ba1cad82a3f6264db.exe"1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1808