Analysis
-
max time kernel
117s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 01:46
Behavioral task
behavioral1
Sample
1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe
-
Size
109KB
-
MD5
08452a7df816a97bd8e9102c7566eed1
-
SHA1
481e3cf48d1a80ed557039881f483fe77504b45d
-
SHA256
1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b
-
SHA512
2044edc56fbe976958d8cc48e67f1cf90daed7b46d72730af766f1555744ab0b8ead609ff9a98628054c601e1dce100d4794a735f39a4a839c9681ff9bad2363
-
SSDEEP
1536:sLOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9Tfc:YwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1612-54-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1612-55-0x0000000000400000-0x0000000000456000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2789221-5E95-11ED-8B83-6A6CB2F85B9F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374588327" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E278B931-5E95-11ED-8B83-6A6CB2F85B9F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1620 iexplore.exe 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1952 iexplore.exe 1952 iexplore.exe 1620 iexplore.exe 1620 iexplore.exe 1056 IEXPLORE.EXE 1364 IEXPLORE.EXE 1056 IEXPLORE.EXE 1364 IEXPLORE.EXE 1364 IEXPLORE.EXE 1364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1620 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 26 PID 1612 wrote to memory of 1620 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 26 PID 1612 wrote to memory of 1620 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 26 PID 1612 wrote to memory of 1620 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 26 PID 1612 wrote to memory of 1952 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 27 PID 1612 wrote to memory of 1952 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 27 PID 1612 wrote to memory of 1952 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 27 PID 1612 wrote to memory of 1952 1612 1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe 27 PID 1952 wrote to memory of 1056 1952 iexplore.exe 30 PID 1952 wrote to memory of 1056 1952 iexplore.exe 30 PID 1952 wrote to memory of 1056 1952 iexplore.exe 30 PID 1952 wrote to memory of 1056 1952 iexplore.exe 30 PID 1620 wrote to memory of 1364 1620 iexplore.exe 29 PID 1620 wrote to memory of 1364 1620 iexplore.exe 29 PID 1620 wrote to memory of 1364 1620 iexplore.exe 29 PID 1620 wrote to memory of 1364 1620 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe"C:\Users\Admin\AppData\Local\Temp\1e26f035177b2c3cdd0f05f95dd6ffc8e30b52c212f3d7ef8839a6c914c7f13b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1364
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E2789221-5E95-11ED-8B83-6A6CB2F85B9F}.dat
Filesize5KB
MD542c049bdcdb46998a25c1f5b1eefa09d
SHA1b42278028c66fcf2bf73eab4b5812ea78b9f789b
SHA2564c63da01bda1922f72132462c259d1068a14b898e4af2878315a0a904747f2ac
SHA512860dcaab3f0ecc9b394f1800d0e776c8378bfc7739df44407a7fc934e084c4efbe60dcd213dc492831bd0da833f1f584e0dbc4dc9646887eff784c1052cd4a39
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E278B931-5E95-11ED-8B83-6A6CB2F85B9F}.dat
Filesize4KB
MD582c2db4b52998a31b5f68b7a7f00f269
SHA196969be6467d794ee7995378431edf7a98a61a47
SHA256b7d742d057f5eee03312f3a4e2e18583b48a567fde5a10e4a3ea3daab34b3770
SHA5120318c1c93071817ac512fd82e78f8a29f4b0af4cb222f22e8e958077b43881aef095524d59eb27ae6f6d2b59598f77e3cb2c08b511961cb19d5991419d23d1f6
-
Filesize
601B
MD5b69f66a3dfd864163a536960e21c4143
SHA1cfa6704fbda3589574ecd3066d0b31af36b45455
SHA256734094c71df497c05e994cb526d76aff4dd8751274a2873d7855785fce77cd02
SHA512bddea761f08d00b58cdba77b009d75f4a40a0355dfb9c642c626e4e08611d438b881fbb002e1efb5da533643def111b765220e59fa27a2baf78fbc7b2639ba44