Analysis
-
max time kernel
112s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 23:54
Static task
static1
Behavioral task
behavioral1
Sample
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe
Resource
win10v2004-20220812-en
General
-
Target
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe
-
Size
80KB
-
MD5
178ab0cd177302208b27e44a76abef00
-
SHA1
8a6d9e3c158237a34b901aa39a40352136d821b6
-
SHA256
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2
-
SHA512
a1e7689ee7c29987d4f8e8c08c235f202ef6a102712701e361ba044ba5bc17e633a82f2da624a683e8e4753e65dbeda7396dbf37295d026cb097d2b7a9e7d413
-
SSDEEP
1536:auP7LRKwuLFsA/DoGXeC6J8/Vo2ByYwOTlRQhlhfh9yjPiN0vs:Fon1/kGf6OCYyYwglCth9y7iN0vs
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exedescription pid process target process PID 1848 set thread context of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c053c3bcffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b55c9d5fd58fe4d8e2ec0366e89a436000000000200000000001066000000010000200000004f0117230156f669afaf9121a1e65e199dbb31aced689ecf79941a2fd76b4b6c000000000e8000000002000020000000714cedd1853bae695f8ed906858fa017e016110c63dec9f554985c9328a59dcf90000000e4bdcbfff0ec4b640f6cfa07631ec52d2cff079baea89ae1f5aa31d3936115ba2abba80f0780b4214085244148d276d585a43087399373b54dd678b4ca8984e0256699591675fcd6c4e01f375b45d1f4a77485ba8f801a67c8cf30fab30b58636bb50dc9e047262d8ea55d54a1f2b485b33d3ec49aea048746f6777dabf7b023f21906da2e343860bddd1d9452bfc03e40000000056e2e0b2b48b34d2046e957535cea1dc200c4f50e96f048b67dbbf2007a0f631b438c4995ac89cf1a09c292d10e286e52b641a9449bc20889a0e6a5cf163908 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376028810" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b55c9d5fd58fe4d8e2ec0366e89a43600000000020000000000106600000001000020000000133f1f9d23e2f2bb9bf334f5a6444b5b13729ec3f13c43ba9ecb2dfad9bd8565000000000e8000000002000020000000c6376767805104e3f81c2a45a35344992f84a033be0b27d420971f81b4201e40200000009753513b4d64b1be9fdaa54daa608f1a0acb920cae5c1b953540bf9322ca69f640000000fdc276c18568f037cd0a7728e52b3dcef513fc450f7da535725393255b0e31e2d85c49f8d480dceda8be89e4b52bea7b6930807853d7a8a0bcb2a4225a175b52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C424CBA1-6BAF-11ED-BB94-5A21EB137514} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exeiexplore.exeIEXPLORE.EXEpid process 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 2032 iexplore.exe 2032 iexplore.exe 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exeiexplore.exedescription pid process target process PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1848 wrote to memory of 1484 1848 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe PID 1484 wrote to memory of 2032 1484 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe iexplore.exe PID 1484 wrote to memory of 2032 1484 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe iexplore.exe PID 1484 wrote to memory of 2032 1484 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe iexplore.exe PID 1484 wrote to memory of 2032 1484 881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe iexplore.exe PID 2032 wrote to memory of 1004 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 1004 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 1004 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 1004 2032 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe"C:\Users\Admin\AppData\Local\Temp\881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exeC:\Users\Admin\AppData\Local\Temp\881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=881586a309cb1b394c2f7677fabd6ec371e17053d034a8c475a41782be6f78d2.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ORJGVS71.txtFilesize
608B
MD5c4422b387acc0a84a84c9490627e7996
SHA13a1e5477af834aa2e26baf1aae5c9cf811da2f8e
SHA2564ded771e9637b4b887a34ebd98dc788e5ad902a23a9a8a334c885566fa879ac0
SHA512ed6c4a3302fde627e60803a08f7da2152cee70f1dc4ae2a9efc30e2b9169baf552f30807c4dbe6f8483e9027000dd27a4cdbb7b286461b58188152eefa241e8b
-
memory/1484-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1484-62-0x000000000040C42E-mapping.dmp
-
memory/1484-64-0x0000000000402000-0x000000000040C600-memory.dmpFilesize
41KB
-
memory/1484-65-0x0000000000402000-0x000000000040C600-memory.dmpFilesize
41KB
-
memory/1484-66-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB