Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
22/11/2022, 00:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mygove.com.au
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
http://mygove.com.au
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
http://mygove.com.au
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral4
Sample
http://mygove.com.au
Resource
android-x64-20220823-en
Behavioral task
behavioral5
Sample
http://mygove.com.au
Resource
android-x64-arm64-20220823-en
General
-
Target
http://mygove.com.au
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998028" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375843396" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048dd1ad2bf5eea499f26ca602abd801100000000020000000000106600000001000020000000584524cd65f61f3319d6c78db5c06a6557cd63bd0aef98154bab1c90725badb4000000000e8000000002000020000000456dc919981d5243c4ac5eb2faacc5294f48985a07a25881fc604dbf09115339200000003a61280ac5dbe7456d642b9c93829877ca50256a88f271d0da4ef4772a2df0b14000000083289aefd307dd1b06a6ac4f2daf56cd9f7b343bcc47931e5f3a295c32a7f2c79a76f1c7d13c724a9f9c2d8247ac49a7333884aca4b87438cedcd74182f1a86d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998028" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4030069900" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048dd1ad2bf5eea499f26ca602abd80110000000002000000000010660000000100002000000078ba5ea366fd168843be35adfbf4bc8be182d5a1eb75ede042e589276b578d92000000000e80000000020000200000004b8f44dc0cf50cab6b4e998f28ef4965b3233b7fa6ef611d54cb20b5be0352cc200000002f586e22fbdda42299094a09e4f05dbac0fab88d85b1b5522d7a1d11844e99ba400000001bdd8c8471c993a7b05d0507be6515e1a3426e30464ef685fdf4861bf1eea6670e556fde097e99a3f28e7195e187227c8332c2f3baa3ec4efabd53346f94e1d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BA21CE8-6A00-11ED-9424-DE2FAD8CE486} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998028" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "375891982" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00abcdf10cfed801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "375859990" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4030069900" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0afd4f10cfed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4036633481" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4944 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4944 iexplore.exe 4944 iexplore.exe 380 IEXPLORE.EXE 380 IEXPLORE.EXE 380 IEXPLORE.EXE 380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4944 wrote to memory of 380 4944 iexplore.exe 66 PID 4944 wrote to memory of 380 4944 iexplore.exe 66 PID 4944 wrote to memory of 380 4944 iexplore.exe 66
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://mygove.com.au1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4944 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5cb295ed32b0acd9eac87bcc961fb315a
SHA1a580f2d38c9d1611e25b6aaa3d79b54eb34d3ebe
SHA256980abeaa872503211925db8acf8bdcdff0bc3c6deb2182fd698f6a444d2625be
SHA512974f48bdfb8ea90a49cfa25cacc98c9a145702f4e4967dd6ffddd5eaee6144189499682e80b342708e04f812006314b04e5715492170d0f63c7b0530e9cd399a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5706cdeca666a4909a1cce79e0fa3ff0c
SHA1f580f107401eea319f374865a6a24aad5225fc5a
SHA2565e1732b54e67fb3060a7aa386efbd3f81c8b9c0c39c6df003db5aef1294f873a
SHA512a2daf9ddc2419af134fd529b28151b914e3b06fe50ebc913ab8929609d47aee85738f1ff4fa52c4df79a664795ef81ccf07faaa0e8274dd525c86432971c03f9
-
Filesize
121B
MD5e3b3e26dce31b9996dc956182e0858e5
SHA14da77f41794db43476a93dff8c9fe8e040ef8a3c
SHA256c0ce16fe3007ba07745d13c23bf3975041b8a3e6be732897e52a4bcf8554f3df
SHA5127f44c6a272d033cb7bde64a592a7f72cf749b5d11cee20d23aed40311d85792af1a5a4e736c16e6ae884d973119978742ac24bf346451ae45ba681c2f41bddee
-
Filesize
88B
MD5beeb8d8bcf049c2e9cce820d1c66d8ad
SHA1a150addfcd4e4487768a2d5fe8ecf398a07b9d7a
SHA256d38b7d6a00a4cc2a0a9e32c02b28879f7adf1f8e5cc1228ee23cdc7f3eb15e45
SHA5120c829441ade41af5d5aa91bf7c6b2f0bd60ca0506ae5f93cfc7d7ee6f6f311bb53098fb67f2b6ddc2db78e41e2405544145fbfe4189ab67c8ab7e6a952b30ce2
-
Filesize
604B
MD57f4264cd7ac2431926b2b586ed9ed4bd
SHA17007fd06b3615ac139d153fcf441867c3bef6d21
SHA256742b1e08064504d62002d6e69037c2a63549ce7e64565a2aee99ef786f2de1dd
SHA512eb5f879b09d9b6f9f9dc0839dd31e0a118840d26f1c6983f1a961fa0be777406dffb5f2bbeaffb54c5ca01c31369411846e13873f7e04923e43a3cdbae16c45c
-
Filesize
605B
MD5519be3a4ae05e9f029acfce791170961
SHA11c986bcad83707113c236b4fbd825350268636ec
SHA2565c6e16694ea00cecc398d07958f0d43cc265e302ad9c316dddb49eae214ac638
SHA5126642cbf9dbab266bf5fb648c0977b44c1b96cd190a6c8c3c9add6a55000ab3fb446e8e992bec08a4d587430bbf6f825c07936ace50088963e5b498b9ff4f4f7b