Analysis
-
max time kernel
175s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:02
Static task
static1
Behavioral task
behavioral1
Sample
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe
Resource
win10v2004-20220812-en
General
-
Target
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe
-
Size
328KB
-
MD5
a7aba4296e0f4cc12ec37491d623ab37
-
SHA1
ed15724056ab1d40053d82ac937f7e7d5489dd1d
-
SHA256
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173
-
SHA512
3c7185050f3229114f40bc3938f9c836aa3e4644e99e550e37693a13abfca52276885c390fdc17d80575dd92c99535cf370bd7d5803eb8187446ed3c4d4b73c6
-
SSDEEP
6144:+ICHmBqlcHgSSrWr/mL+YcXMIe5EC6t+jqBEm2mSMb1dxIm33liQzMcq/rtDzB59:EHmcl0gfCr/ocXMIkgFdpHxIm33llbqD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pidgin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe" d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exedescription pid process target process PID 1516 set thread context of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8041f7a44affd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B48A0A61-6B3D-11ED-87F1-C6AD45B766F5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000d656417dca52371fda317091a39bc3a715b941ffe3bedc4ee090519e78f563c1000000000e8000000002000020000000bb9396f5a851f35d8008b0f7b4239de754520b6a78c3e74f8064aeb83b5c8d2e90000000ed94045b780fdefde09042f692f5a6f1c699ed364e36502b1b3193de856158478a94c31b756f7be30d2491d51f5f91fdbab766546df36a7163cf13c9d6883a52d1f83a6381e3130676b664535892f0414f5089d756d6b80e2d2e85fa616f801a4796751e1000a82b5faa8a568e001bed3be9661dc4bed9898d9949b7c1e261db685944a0e4fc586b8cb4541d6bcaadab40000000fef63efcf8bf576b517c67f5d275171afeb3a0dd39dff1e0489df81b74b38c99db0064cf0ae0d4b87dfcae73148dbbca1b366e3d8bd0d057e23f0b883f600da7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000f7a85e2ac42e17496c30db255ae3656a243772d0632275eaf98e4ec79b9bebb2000000000e8000000002000020000000c0cd78206733eb12012becec8c44f5007f8d4b020b0d6b12e13366e26573482e20000000439fe1d7e7504f09838c2f0b136424543d2309b9794302e2e0f092f1e491f47d400000005a68519004051a1ac104b4c629b5f8083da056980d165ad21f6af8377e94b3de006e9d5cfff2924c43cbf5754a6c9a0691d7d1f81a932a75f142c89d9773fbab iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375979816" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 896 iexplore.exe 896 iexplore.exe 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exeapplaunch.exeiexplore.exedescription pid process target process PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1516 wrote to memory of 1636 1516 d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe applaunch.exe PID 1636 wrote to memory of 896 1636 applaunch.exe iexplore.exe PID 1636 wrote to memory of 896 1636 applaunch.exe iexplore.exe PID 1636 wrote to memory of 896 1636 applaunch.exe iexplore.exe PID 1636 wrote to memory of 896 1636 applaunch.exe iexplore.exe PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1084 896 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe"C:\Users\Admin\AppData\Local\Temp\d27e0ef50747340368a6b4a9244381fb34f1ab9778aa0c13a15c6dd4569b6173.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=applaunch.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0FAQCP25.txtFilesize
608B
MD5aadaaa698393a8c1905d178e5680f066
SHA12f067393cb07121b4037277e4886c0e41909354d
SHA2567d8bb18808f13b97cda750496f80c0246398c65b2270f187e6b3729068a4952b
SHA51270533b334222b3b78f9ff543efe4bcc4db2e8d23910a77b7147d495f1adcffc1356815f5a6b3aed3fc83abadcf5836d071f6ca8d1741bc12e5c44f04103200e2
-
memory/1516-65-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1516-55-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1516-56-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1516-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1636-57-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-61-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-62-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-63-0x000000000044501E-mapping.dmp
-
memory/1636-60-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-66-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-68-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1636-58-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB