Analysis
-
max time kernel
141s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 23:53
Behavioral task
behavioral1
Sample
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe
Resource
win7-20221111-en
General
-
Target
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe
-
Size
85KB
-
MD5
e3ead99da0eab7e16219d8c344ceb83c
-
SHA1
42bf753e5ca905cae733e79008d6d7ed813cdaec
-
SHA256
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05
-
SHA512
14df1b2481ffa0203784816bb87bf040195bdbcfe2ffa40bed0c25b257f7d3a3edd7dfe61b452a97cfd9562ead1ca9b08c5125e5cd41a023157dae917fb39671
-
SSDEEP
1536:5w0YsozcsH+BeiE3/Tp8YN2Q9Hhxzi2yiKlmtQDlKODyUJdncip0JoEf:5VkcsWEP9LJZFy6tQDlrDya5702Ef
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1208-56-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral1/memory/1208-65-0x0000000000400000-0x000000000044C000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exedescription pid process target process PID 1208 set thread context of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000002acf57e68773b0d131c25a532b90359587346710dae46403626436795c33e818000000000e8000000002000020000000bcee9533cd43af4fabb3312d08030f03fa98c25191af8a630bdb660db6849b2f9000000011105be20ace396ed22bf253dc761e01bdaa6588d579d03baa950c4625adee4ca41f72c3a477906dccd5a34de94afdc15866894e8522690841263d17be7078492833bd4123af65bf217028d1f2096cde43afe3602935bd9f480a7ae9c458adcf443d4a032e786b97030add5216c114e6881b990ae31d3f97bdf4370f9ff2aacbc83b2343b53b7d9290595b5a3b68c68f400000009ef612c87b5d036c511d029b15123c2ae789e86399444403593fca95e4469652200fa19b3cb54601f9b48b2350fd83bf6f1d445885e018583a0046efd27a8254 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02e0897bcffd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B40F3DE1-6BAF-11ED-B3C3-5263E908E3CD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376028768" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000bada9bb52b682edd9744db35838d4ba2c9ec0b65bf7d7df535373191cf478825000000000e800000000200002000000072bbcd56238fabd7b529c3f482aa98f1582401380551ca406603e2f31c285a1320000000163571b971e857349c1fc25b50d07367f8e907fe79db2ca34ff189c6f5defd2240000000f1a8179906fbdcc88a52120b5bcdffd13c6ea1d9f8a49921ce1450530d9f5041e9ca2b326d9bb61827e6fa972fe3df60ba430d287297c09ac96aec1b510072e9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 336 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exeiexplore.exeIEXPLORE.EXEpid process 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe 336 iexplore.exe 336 iexplore.exe 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.execb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exeiexplore.exedescription pid process target process PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1208 wrote to memory of 1956 1208 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe PID 1956 wrote to memory of 336 1956 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe iexplore.exe PID 1956 wrote to memory of 336 1956 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe iexplore.exe PID 1956 wrote to memory of 336 1956 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe iexplore.exe PID 1956 wrote to memory of 336 1956 cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe iexplore.exe PID 336 wrote to memory of 1436 336 iexplore.exe IEXPLORE.EXE PID 336 wrote to memory of 1436 336 iexplore.exe IEXPLORE.EXE PID 336 wrote to memory of 1436 336 iexplore.exe IEXPLORE.EXE PID 336 wrote to memory of 1436 336 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe"C:\Users\Admin\AppData\Local\Temp\cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe"C:\Users\Admin\AppData\Local\Temp\cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cb897acedcc2bd770876cca277441124d79063dcbacb37d3ac84382bc6773f05.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:336 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AJ6BFJYP.txtFilesize
608B
MD52f4ad14197d644e7350ccd5a0d091327
SHA1d497eb596dcb95c0c8b01e0bbd5f035350e9b529
SHA2564dbf4adf8ec57a9106cfe08b350f93061ae55de4e02a079568cbcdd1e457aac2
SHA512849b91cc0b1929b26796777479a17be3feb779523ad84e50139d6acffaa9008c9ceee185d23ca7a0a3bb3517d78a150d6f7c4a18c1ad4cba285f73f040870a7d
-
memory/1208-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1208-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1956-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-58-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-63-0x000000000040FD42-mapping.dmp
-
memory/1956-62-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-66-0x0000000000402000-0x000000000040FE00-memory.dmpFilesize
55KB
-
memory/1956-67-0x0000000000402000-0x000000000040FE00-memory.dmpFilesize
55KB
-
memory/1956-68-0x0000000075C21000-0x0000000075C23000-memory.dmpFilesize
8KB