Analysis
-
max time kernel
367s -
max time network
435s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:51
Behavioral task
behavioral1
Sample
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe
Resource
win10v2004-20221111-en
General
-
Target
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe
-
Size
466KB
-
MD5
4444fdd8a9c1a6e6ca191054bf4039c6
-
SHA1
1b6fee86baaeefe746d932361203b9bf27fad5f9
-
SHA256
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced
-
SHA512
97dad2cbb4c94c8a3fabbcfaa6dd4367b8b394ca4dcf151da7d576b60968064d7702f8e10ac43a6233ff91f0a5c8c9dd5ec658b3c5af1b3994e2fde4ac4b64e3
-
SSDEEP
12288:Fr3+AZz6vIlBP9S/hsbRbG8LJgEFm8BDVqdEyoFWVoBX:Ff1lyhsb97LiAm8BxoErFWyl
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{784B825D-6B5B-11ED-B5DD-66300FA194E6} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exedescription pid process Token: SeIncBasePriorityPrivilege 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 456 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe 456 IEXPLORE.EXE 456 IEXPLORE.EXE 3940 IEXPLORE.EXE 3940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exeIEXPLORE.EXEdescription pid process target process PID 1360 wrote to memory of 456 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe IEXPLORE.EXE PID 1360 wrote to memory of 456 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe IEXPLORE.EXE PID 456 wrote to memory of 3940 456 IEXPLORE.EXE IEXPLORE.EXE PID 456 wrote to memory of 3940 456 IEXPLORE.EXE IEXPLORE.EXE PID 456 wrote to memory of 3940 456 IEXPLORE.EXE IEXPLORE.EXE PID 1360 wrote to memory of 1740 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe cmd.exe PID 1360 wrote to memory of 1740 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe cmd.exe PID 1360 wrote to memory of 1740 1360 6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe"C:\Users\Admin\AppData\Local\Temp\6a61d550ead9604617b2979b67d6da5b095e559c6623ff6d19879a2feb939ced.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.wa300.com/tj.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:456 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6A61D5~1.EXE2⤵PID:1740