Analysis
-
max time kernel
199s -
max time network
278s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
Resource
win10v2004-20220812-en
General
-
Target
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
-
Size
182KB
-
MD5
80bc0154f11ae4eef55b00c464ae1723
-
SHA1
312fe24ecf4c6d84ef7d05a8c3ae85230920b884
-
SHA256
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e
-
SHA512
198de65ec5764acf57223c1e8059786bfe8176145e1ecddd17ffc906ccb05c17d2ff483922f56a45df8f49629e5bc7137e54555c4b2aa193c772e7342d6aa12a
-
SSDEEP
3072:QGO+VHFPy4q+og2XLD9ryWacSMnqBSMVHjRcg:QeVHiJg69GWaSq8Mpdc
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
iexplore.exepid process 344 iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nwkhku = "C:\\Users\\Admin\\AppData\\Roaming\\Nwkhku.exe" iexplore.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
iexplore.exedescription ioc process File opened (read-only) \??\D: iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exedescription pid process target process PID 1164 set thread context of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376154119" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87BEB111-6CD3-11ED-BAC3-4ADA2A0CA6C6} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXepid process 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXeiexplore.exedescription pid process Token: SeDebugPrivilege 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe Token: SeDebugPrivilege 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe Token: SeDebugPrivilege 344 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 896 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 896 IEXPLORE.EXE 896 IEXPLORE.EXE 992 IEXPLORE.EXE 992 IEXPLORE.EXE 992 IEXPLORE.EXE 992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1164 wrote to memory of 1520 1164 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 344 wrote to memory of 896 344 iexplore.exe IEXPLORE.EXE PID 344 wrote to memory of 896 344 iexplore.exe IEXPLORE.EXE PID 344 wrote to memory of 896 344 iexplore.exe IEXPLORE.EXE PID 344 wrote to memory of 896 344 iexplore.exe IEXPLORE.EXE PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1520 wrote to memory of 344 1520 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 896 wrote to memory of 992 896 IEXPLORE.EXE IEXPLORE.EXE PID 896 wrote to memory of 992 896 IEXPLORE.EXE IEXPLORE.EXE PID 896 wrote to memory of 992 896 IEXPLORE.EXE IEXPLORE.EXE PID 896 wrote to memory of 992 896 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe"C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe"C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6CYNIGOB.txtFilesize
608B
MD5f89962a79d36a0ffc53e06698047c55c
SHA10dc9587b14ac8f542b77969027c21ac85f20916e
SHA25601c68fa966e528f7a420cb09782c53533e01ad4164e803677ebe5e5aa27916a7
SHA512ce996e633581ae591898ea6a3716998954980837ab6b247faa822956f6d2356b5ba9716388a2cf6fc1817f37ff5fff60275e0fef5003a2a34961e13a7be8d4e0
-
memory/1164-54-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1520-89-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-136-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-62-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-91-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-67-0x0000000000410910-mapping.dmp
-
memory/1520-66-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-69-0x0000000076931000-0x0000000076933000-memory.dmpFilesize
8KB
-
memory/1520-70-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-71-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-72-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-75-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-77-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-79-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-81-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-83-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-87-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-57-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-85-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-64-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-60-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-97-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-95-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-99-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-101-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-103-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-105-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-109-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-111-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-113-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-115-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-117-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-119-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-121-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-107-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-135-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1520-93-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1520-58-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB