Analysis
-
max time kernel
107s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 11:02
Behavioral task
behavioral1
Sample
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe
Resource
win10v2004-20221111-en
General
-
Target
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe
-
Size
1.4MB
-
MD5
2db0597e0fbbf3aab93dea3ca76db883
-
SHA1
9b431e5d427176fe9bca82464322be3f3a723187
-
SHA256
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543
-
SHA512
7cc86eddb9be47dda8bc03197319ba686f46ff765b8bea2260ba308f720d7ccee73dd868b7ee92eb973f3a1a15986039659c09c572cae2cb6477ee01dbf223ca
-
SSDEEP
24576:YOhS6Gp4FvrTVAoByFq45oMWTSV0Oq20dGIIxocDIukNdl5ThASKYReX5kPTwHH:NndrTtMquojTSCOIOlCTyfX5kUHH
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1812-55-0x0000000000400000-0x000000000072E000-memory.dmp vmprotect behavioral1/memory/1812-58-0x0000000000400000-0x000000000072E000-memory.dmp vmprotect behavioral1/memory/1812-60-0x0000000000400000-0x000000000072E000-memory.dmp vmprotect -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4e404e2ebdef147bfce113be4c08fd2000000000200000000001066000000010000200000003f2ca031013ebc9c54e366cdabeda13c1304d47f65067fe2fd6a1e59a99ce4e0000000000e8000000002000020000000ad6f95bb8bd8f7a62af5ca092f0431f3262946f09e6bf55bcdf1f5fddabf9e91900000004ce474bc227a493279739ad86eaa347dad4a5981631d4a5a05fb893a88e0b9ff37ee9834b791caa22e6af765dd7ff72a4bc013edeca3f5fe532bd2e5ba3798f4efb60cc971885ac280d2a500961241d08fab5a2b0984b6749c10e686d18e8af19ff0d88c624b039ef1e648edf0f22bcffdf07eff1bd2942f0efa5c14bd2eb49162466a28aae3067de5737ff5816c5cd740000000b0b261e4fc2dfc93ce1a60ab545895f706c6bfbe53c66945324c46b26d57efeecbe747cbed01bf3eaf914ecd49dbb33c6e9348a6925a6fa06a5cbb69ced9ed2f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4e404e2ebdef147bfce113be4c08fd200000000020000000000106600000001000020000000723267fad873e6fa4b72a17299a7ae766e96df399cb8b1b8fc61b14a520f6c4e000000000e800000000200002000000095393909ba41c288d2bb139d98afa04bb338dd52453594907321aa072009ad48200000009fb6cbb6514c35684fe90ad9fa7f000a4bf9f67d5fc74f3c13362963f8e49f2e400000006c95d8a6e760548902cc8f9cc68ea405e3b37bb32f839c2b81ca224aad69f7929edabf38a4047c50b98618b7104ae39d10410869e9888861a1a28257ede14f08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376387654" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E5169A1-6EF3-11ED-9351-5A21EB137514} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05fcc230003d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exepid process 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exedescription pid process Token: SeDebugPrivilege 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 592 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exeiexplore.exeIEXPLORE.EXEpid process 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe 592 iexplore.exe 592 iexplore.exe 704 IEXPLORE.EXE 704 IEXPLORE.EXE 704 IEXPLORE.EXE 704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exeiexplore.exedescription pid process target process PID 1812 wrote to memory of 592 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe iexplore.exe PID 1812 wrote to memory of 592 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe iexplore.exe PID 1812 wrote to memory of 592 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe iexplore.exe PID 1812 wrote to memory of 592 1812 b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe iexplore.exe PID 592 wrote to memory of 704 592 iexplore.exe IEXPLORE.EXE PID 592 wrote to memory of 704 592 iexplore.exe IEXPLORE.EXE PID 592 wrote to memory of 704 592 iexplore.exe IEXPLORE.EXE PID 592 wrote to memory of 704 592 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe"C:\Users\Admin\AppData\Local\Temp\b98932763d82836e2de77e3043b1687db27a17ea98fc1532818032d4ea9f2543.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.cfxindong.com/#network2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:592 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:704
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1852NK2B.txtFilesize
603B
MD5f56248646272fc447c8b940dd11c4050
SHA102d3a67530a67fa34273982ae20ed6ab950f7cbb
SHA2568d6f22de3592424b2948e3c2caad9d40cf2cf3122f2e3e7260d869543864209d
SHA51218df24d0b029af8b4f1ebb7a7db0c77ac50a5c2b2d270bd50fbc37308926f6acde4c7b0cd946d6d37cee1c736927a243e4d7409621e30fa21081792b49b583d1
-
memory/1812-54-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB
-
memory/1812-55-0x0000000000400000-0x000000000072E000-memory.dmpFilesize
3.2MB
-
memory/1812-58-0x0000000000400000-0x000000000072E000-memory.dmpFilesize
3.2MB
-
memory/1812-59-0x0000000000130000-0x000000000013C000-memory.dmpFilesize
48KB
-
memory/1812-60-0x0000000000400000-0x000000000072E000-memory.dmpFilesize
3.2MB