Analysis
-
max time kernel
73s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kso.page.link/wps
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://kso.page.link/wps
Resource
win10v2004-20221111-en
General
-
Target
https://kso.page.link/wps
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff828cbb81571346bb28c38e80f5a65000000000020000000000106600000001000020000000c3c250f2b2836eb6baa81693082ca85e377a9f1e6aafef6dc87af97cb9fd8515000000000e800000000200002000000042d0db29e4f5d9c10dd3c24a4ace6811977770991e13b1a62db993ecf2a5882590000000d3aefa00e6a83d6477085f6fd7917df394f083206f7b5f09ef972c5322196d9ae60a4343c53123d70b155af3004e539f7605bfd6d0dd7c72b91d9f8de6a6de05b6cc8928a63f411f307633b10648d50569412b886cff13699005260b8a07eb9d2b4f9845f67398a620bd31598fcf4fb2b3a051d9c9067d2879ccd3048b3be9d3a85b3947776fc0c363d6365f9f688f4a40000000e36444cc0108a1c7764ee77f19e9b04c5dc7272c6abe58d6c3283ce8a4f2d90c7843d47502632f422269a6c303df6f5e16cc41c57ed75c877c2ac578beac00f9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209675c039ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1B482B1-6B2C-11ED-8CD5-EA25B6F29539} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375972583" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff828cbb81571346bb28c38e80f5a65000000000020000000000106600000001000020000000506b7ac509d066f0b9cc8829a480d994eccb605a85209272dbf418aa540a8045000000000e8000000002000020000000ae0bf8869f2bb136c681b210ee6529169f9159125bfd1cf124008a8ffe8e143420000000b9b38afdf199af79a5f4d77fbbcb66ffdaa40e57dcb8dc40c427a7dd8ea31a9d40000000b98cc332bb6a3e8cc220c257df7b2eff5e5cd34e7cfd80645a70efa93db279abe0181fbe47c7e2af28c660b24f5f8a4311dc9452fb81e4c29ea98ddff6864457 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 836 iexplore.exe 836 iexplore.exe 1508 IEXPLORE.EXE 1508 IEXPLORE.EXE 1508 IEXPLORE.EXE 1508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 836 wrote to memory of 1508 836 iexplore.exe IEXPLORE.EXE PID 836 wrote to memory of 1508 836 iexplore.exe IEXPLORE.EXE PID 836 wrote to memory of 1508 836 iexplore.exe IEXPLORE.EXE PID 836 wrote to memory of 1508 836 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://kso.page.link/wps1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD51c63c37132f82e88837ec61f837894c6
SHA1dd38bcf63d6772b7a636c7dfae1df497d447fa84
SHA25609a06d9f5043c9dab9e93e0bcc7d9972f8613875a4b0e0af2b198560a999aa76
SHA5128488b94dd410bd83d2ad7da18a4b00abfd1d5375649e6a6a8a1f622a187b89bd32fd47f6a960f2306409c5b6a5ac395f9a2c8f7c07c7f18f1c1500281a7cec9c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZIIBE825.txtFilesize
600B
MD51226fb5da49330eceba33cc5b5f0384d
SHA1f783a54e1e349723339cd521851255e6266ab962
SHA25623803b84273f66598dc731f9ff4720bfdd043d735beb7ef0cd833c48e767b799
SHA51265fbfc21692ca89357df2e3b2efd3c225d6ff4a14f871d6ad37a76478fcd9375268b4801b20a4634d5d2011ddadd6bb90e613e8067155367771c27d4704e7597