Analysis
-
max time kernel
107s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe
-
Size
449KB
-
MD5
062c1c136649b1d6c191a86710fccc2c
-
SHA1
7e6bbc7bac6ac63e01c28910f338c1fc481e06fc
-
SHA256
fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d
-
SHA512
03d7c5607129428364875faa1adab0b44c214c9541e63184912b2a42467290fae6a515b3c0648784cf3f6f77a18eac67d6fe2a859a582293db4b63c00d7a2378
-
SSDEEP
12288:q0+GxSV74cwpgpJq3m6qkdKEFOwrv7m+ed/f05wCDPSdptRlJFn:pxe8c8gp43NdZLref05wrfRlP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1304 cmd.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B650AD1-5DF8-11ED-B68C-6A6CB2F85B9F} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305c184d05f2d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000004551b1f5e1091e73fa036ee2dd78ee16afd8792794e684e3199ad281a05dab9d000000000e80000000020000200000003aeaf42350952296771368de04ca92975075509b75115b3469227aa7ce0afe17900000000b058a7500604a3c2ab48ec70547cb8eea9a2c635b886dbe2dff65744fedd7f4dc101d7d8880763a067f76f42ae8608e36f3ad024b741f5bc049ba4d2e60b2fca4f2a2fb0ffd6ef59e63afdf7dc75fdd3592982fd7138a2e5db77d8ae5700bae66b05608c50f964b4f1595b0e37f8fef2a72ae4da40701b595b890cb66bcbff31a0a9437de2d2fcca9b07b1204affdd740000000bd9a3890887992592605e009afe0fc078bf1a71ae9d5f0fec6d3e3ca6d99852008edc754b099752d7f472481335ad1b5a115611e705899f304f29ddeac2fc960 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374520689" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000d1332b44fd70ccb07330771412ae222fb76b264903a037857acaf51b64e82609000000000e800000000200002000000077f6e0cb8b505d1575ec8ec8cc2a592db58cfb3de15aae92a8a9053184a71df420000000ca51ef448f7eb02ca9b7638d9e308b23ca35f3dea0f00f3655fde35863ad92ca400000000775b688499ac6912c5c0c8cd63af475f21434c4ed830c628a3b921846f1c2643831409579aaa7aff31a1eb9b5e7af2633e0d20d688fd95664954749735b4cb4 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1428 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 1428 IEXPLORE.EXE 1428 IEXPLORE.EXE 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE 1544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1428 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 28 PID 1752 wrote to memory of 1428 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 28 PID 1752 wrote to memory of 1428 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 28 PID 1752 wrote to memory of 1428 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 28 PID 1428 wrote to memory of 1544 1428 IEXPLORE.EXE 30 PID 1428 wrote to memory of 1544 1428 IEXPLORE.EXE 30 PID 1428 wrote to memory of 1544 1428 IEXPLORE.EXE 30 PID 1428 wrote to memory of 1544 1428 IEXPLORE.EXE 30 PID 1752 wrote to memory of 1304 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 31 PID 1752 wrote to memory of 1304 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 31 PID 1752 wrote to memory of 1304 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 31 PID 1752 wrote to memory of 1304 1752 fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe"C:\Users\Admin\AppData\Local\Temp\fc4120d34aae33598727d717db0c95c5e49874bd78ff337f02dad872ddb0749d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\FC4120~1.EXE2⤵
- Deletes itself
PID:1304
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD507b72e9ba27975b7ad3c3f81892c5adb
SHA1c2969564b894480ee91ee5b618d377032cb3c4f8
SHA2563514f566c3d57d40c1ddfd49b76e61c38687361df324c6b7b8280f5eed9f0101
SHA512db1f9833b54950019e59cef7c5f4659f6c78817df7e43df50d141b25753ee9979e67e7db8dbe0985da4ed0e6c64fc6c09e715393965f545eaf3b43517f513c3b