Analysis
-
max time kernel
210s -
max time network
236s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:26
Static task
static1
Behavioral task
behavioral1
Sample
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe
Resource
win10v2004-20221111-en
General
-
Target
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe
-
Size
157KB
-
MD5
9798ce2026ed42d5adfa8a5d5605c8c0
-
SHA1
d113c04507d20bfaff4cc57337bf85bb977ca4b0
-
SHA256
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619
-
SHA512
0f4f3ca13d1d07012134822c114c9922d135dadeb0f618e4011a9b186c7da5ec47559670855fbf013e9dad6c1284192d31050ae76a8d0a5f8082d4ff1dbe3ec4
-
SSDEEP
3072:WrI6aab4ojCfLLnMBviSRKXm13eLjZ4PTczpoU0vjAn2csbhUdptJKvy:WHbJj+QZiBXYeLiczpgvBFhU
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exedescription pid process target process PID 1976 set thread context of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2076448938" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2076448938" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998869" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998869" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376204433" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A694A9EF-6D48-11ED-BF5F-7295FC24CA51} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exepid process 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exeIEXPLORE.EXEdescription pid process Token: SeDebugPrivilege 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe Token: SeDebugPrivilege 3824 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1240 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1240 IEXPLORE.EXE 1240 IEXPLORE.EXE 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE 3824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 1976 wrote to memory of 4972 1976 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe PID 4972 wrote to memory of 2268 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe iexplore.exe PID 4972 wrote to memory of 2268 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe iexplore.exe PID 4972 wrote to memory of 2268 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe iexplore.exe PID 2268 wrote to memory of 1240 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 1240 2268 iexplore.exe IEXPLORE.EXE PID 1240 wrote to memory of 3824 1240 IEXPLORE.EXE IEXPLORE.EXE PID 1240 wrote to memory of 3824 1240 IEXPLORE.EXE IEXPLORE.EXE PID 1240 wrote to memory of 3824 1240 IEXPLORE.EXE IEXPLORE.EXE PID 4972 wrote to memory of 3824 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe IEXPLORE.EXE PID 4972 wrote to memory of 3824 4972 0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe"C:\Users\Admin\AppData\Local\Temp\0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe"C:\Users\Admin\AppData\Local\Temp\0ad147dd31bb6e32f849b9bece7d2f0c830210b561ff2d7ee5d520701f0c2619.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-132-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1976-136-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4972-133-0x0000000000000000-mapping.dmp
-
memory/4972-134-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4972-137-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4972-138-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4972-139-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4972-140-0x00000000021B0000-0x00000000021FF000-memory.dmpFilesize
316KB
-
memory/4972-141-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB