Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:17
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://plhzoe5hkr3k3iy4kbwd3e43lkr6a7pvxqmezdcalr7vdy7fa-ipfs-w3s-link.translate.goog/q9v.html?_x_tr_hp=bafybeig2v&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
https://plhzoe5hkr3k3iy4kbwd3e43lkr6a7pvxqmezdcalr7vdy7fa-ipfs-w3s-link.translate.goog/q9v.html?_x_tr_hp=bafybeig2v&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]
Resource
win10v2004-20221111-en
General
-
Target
https://plhzoe5hkr3k3iy4kbwd3e43lkr6a7pvxqmezdcalr7vdy7fa-ipfs-w3s-link.translate.goog/q9v.html?_x_tr_hp=bafybeig2v&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]
Malware Config
Signatures
-
Detected phishing page
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000445723f2f0d5914cf061c482ea8dfca66677dc8c059a262d6ebc30a9d90c8dc0000000000e800000000200002000000053b22066f920aee2d2f49957ceb31fc41099ed616f7201d0f8c3b2092819df8090000000da55fff4c5860cff725c38f72dec33857a40914208af2abb3dbe78254e39dc471f4e4e783635953051cecd4f660afbc00affa7b4a2d3a5e1a02eb11b62bba546c1998656859d914ff2bf09b68ea161875068f99a5d0ad913d57fa721711f23e3044be2c439563251dc9058ec40a2080d03590b0ce8707bcefd43a03cf5c930f61363c3882a81df8cd47b7225073554284000000089da8469bfcd51ee8a2ce6cf2382968ef00bfc1f39cbf9b09da5ccfedeefee97c52c708fe633afd5e5df3f69ec1408780b606ef2e91a53f8c3f63879e6e2ddd8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376154470" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{622FA6B1-6CD4-11ED-AD07-6AC8E2464E73} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a4483ee100d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000017e656287eecec43820b21a1acb29f749ea027bc29547cb15fce8cb2e3175344000000000e8000000002000020000000c1a09991c4687a4a3ddf10cf1a9566e93aed1d22df9b914176a4ccdf4954652b20000000167248acb82cd23637a05b3a3220c57842ac24bd89b55eff92c1bc486b8a28fe40000000b940cbae1dd01a4dafbd9f9f43d0ee13dbc62eba550a27774eafa086a52c25c815f024191f79165962ba3d307ce6dd6c21f970d00d81cf8f3e35cc19ebadd4de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1768 iexplore.exe 1768 iexplore.exe 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1768 wrote to memory of 1616 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1616 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1616 1768 iexplore.exe IEXPLORE.EXE PID 1768 wrote to memory of 1616 1768 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://plhzoe5hkr3k3iy4kbwd3e43lkr6a7pvxqmezdcalr7vdy7fa-ipfs-w3s-link.translate.goog/q9v.html?_x_tr_hp=bafybeig2v&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#[email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442Filesize
1KB
MD540fc2d3fd38a171ca49f1ebf632e1903
SHA13acc79a441ac1aea5e50d24a0cc619ccf7a3b81c
SHA2563675deed33abf58cdf735b4f52de6a7300c2c3c0d330fa6a0134cb46b43ef8c7
SHA5129a54f9771b0d0afd24efa465f3f52ec357bd7e7b9e0973319dec29172344f8777a837ad0fd4c5b42d725a3da4eb4810db684712d2ee6df6393f7947465991685
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442Filesize
446B
MD5683c0c92d2b8cd3541a6b27429024531
SHA11bbe5c92851d65dce8955c4a4b4c4a606ad1bc31
SHA2567b0f022b572a686fe23a6614d38b7a6ef54e6d9216f994d9f1039933c4a5866d
SHA5123c0290386da3ed77538278726f698547cbb7213956862d849aaea6fcd9144a181e56331879c8aca3a0678c76a1f122d94407d907bc8b6df2a015e03be5cc6884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD551434b25f38197aeb95a7c6370a86a0b
SHA1b9e76795ed0bff5109b645aff5c181742ec6a8fd
SHA2567a2a27dae0f060f97fcd7ec8e88282ac28b28302ce6ff84d2aac1a0d00d55cb4
SHA512e4319bd577f73ed15d09028bfaa6502d0fd97034f7189c053bb5394377550e41a3a51dad3aec9add669e8a799cdf4aed148cf51bd03c1f01d0a6f7be4e718576
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WTE2AMAG.txtFilesize
608B
MD56f6d1de0e8d7837c7bb80621397683cf
SHA1448d4a307f1a577609e71ceaa465f6cc371b421b
SHA25612c4061c28acc2de65fbbb108f17ba3b0db13b3461e2a5c1b40eccad6a7a76d8
SHA5122a143371858c57f5ac59c5f247be5abf4637783e048fad852e0e453d595e8e7310e8e3a13e29d93eceb2bd3da0d5fe4abfa1875d965283e09e234a1b2aa0774d