Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
06/11/2022, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe
- Size 461KB
- Sample221106-p3rscscbf5
- SHA256 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f
- MD5 0fb3f5f0cb76c1e05fdba53138141e0b
- SHA1 c0e7af401f920fdcde32d0da47783e91e033b276
- SHA512 0b35f37c1e4268ed8a563b4c8a5208ad26b036927bf0399cda74cd768fb8a5da0d42bee57117f9ff8a04abef0845670662048557127592594023908fe928906e
- SSDEEP 12288:ht99YEY3GlWRLb+T/HDOt7qEwUdC9QkGLEZAzWOprRc7go:B9AMWRfY/HESuC9QpLaAzWOo
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000036147e410789da23e90b3a6f28d3679da67e22864ec169fb4cd0cbf941a4b6cb000000000e80000000020000200000006c5173da7d49a60e1f99fc1248763c33a018a3c8ee36b34a4a042eac5866791b200000005617c4f81dc97c2bce927141a6afe7df8506991f36951af8a0fb03be5e108e0440000000024378db52a505c0f59c7eb880e30bb42fe02cbba17d1fc2dc9a906e73684b4a7f12acb001e69a2bde64e8cfa9cf8730801fe509f1d39d0eac0481f041f45818 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30994949" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374520691" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70deff4305f2d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000001720159e57b99978f57c2ca978f351a132c0bbb118aad389412497b96127f6dd000000000e8000000002000020000000c408233c991fe1f106c16ab4c3fe323bb9a6392c4f4957b990450e527600b8b320000000ab752bb363dd3ae6002ec560a68e5c2e446eb23738a2eec8b0ab3b5a0e2e54f4400000001124ab639654131278cb00747532044424ba6fc340b43680090d58ce846142cbdb24cfc9955cf5d486ee70c21ef7087a21635d3ff1246d8f6c3f9c10a4d42fa1 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6D530BFB-5DF8-11ED-B696-E23A5D90AA50} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1106003746" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4080104405f2d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1106003746" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30994949" IEXPLORE.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2280 IEXPLORE.EXE - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 3564 IEXPLORE.EXE 3564 IEXPLORE.EXE 3564 IEXPLORE.EXE 3564 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4852 wrote to memory of 2280 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 81 PID 4852 wrote to memory of 2280 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 81 PID 2280 wrote to memory of 3564 2280 IEXPLORE.EXE 82 PID 2280 wrote to memory of 3564 2280 IEXPLORE.EXE 82 PID 2280 wrote to memory of 3564 2280 IEXPLORE.EXE 82 PID 4852 wrote to memory of 4964 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 83 PID 4852 wrote to memory of 4964 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 83 PID 4852 wrote to memory of 4964 4852 ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe"C:\Users\Admin\AppData\Local\Temp\ee4108cf4f85dd1a906726b2ee41756889d91bcc1e5c669686375617c176ab4f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EE4108~1.EXE2⤵PID:4964
-