Overview
overview
7Static
static
URLScan
urlscan
1https://match.deepin...
windows7-x64
1https://match.deepin...
windows10-2004-x64
1https://match.deepin...
android-9-x86
1https://match.deepin...
android-10-x64
1https://match.deepin...
android-11-x64
7https://match.deepin...
macos-10.15-amd64
1https://match.deepin...
ubuntu-18.04-amd64
https://match.deepin...
debian-9-armhf
https://match.deepin...
debian-9-mips
https://match.deepin...
debian-9-mipsel
Analysis
-
max time kernel
68s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 15:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://match.deepintent.com/usersync/141
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
https://match.deepintent.com/usersync/141
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
https://match.deepintent.com/usersync/141
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral4
Sample
https://match.deepintent.com/usersync/141
Resource
android-x64-20220823-en
Behavioral task
behavioral5
Sample
https://match.deepintent.com/usersync/141
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral6
Sample
https://match.deepintent.com/usersync/141
Resource
macos-20220504-en
Behavioral task
behavioral7
Sample
https://match.deepintent.com/usersync/141
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral8
Sample
https://match.deepintent.com/usersync/141
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
https://match.deepintent.com/usersync/141
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral10
Sample
https://match.deepintent.com/usersync/141
Resource
debian9-mipsel-en-20211208
General
-
Target
https://match.deepintent.com/usersync/141
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000007ce525a1428b687db2975b7562ee6168ac1b20efcf8705bcb0a568357ba4fbc4000000000e80000000020000200000009a6b3bd7fd422ddd686c88e88186b091f2851865cc4c62d3d3182ed3229f4e3820000000a785959990e2b008018c5ff1a703602aa698af3cb833548e6839657cbf72a56240000000a469511f27417ce833162a22a53ddcd60629c438cd0df92ca9d557ba4f99fdcb96466e012c16bcf2cd62a5ecb306e7bef04cd02731d76061fd047c82538a451f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509501ad0504d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1C2F1E1-6FF8-11ED-A45B-DAC72961D548} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376499974" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006e2ff84a2c88f39c62958f0dd049e57c7843ee78abdd0d809d09359e7ad8cc01000000000e8000000002000020000000a3c82c6c3b0dae3731d24a40b8e262f3bb640be0c280434254d87f6076b6090e90000000c87bd1f371d99d47933dced85b50fb5544a2dd3ef879650001450a1c53609fff7afa59ff1676b038da9434d1cf4d56fec2eb0b78bdfc9d406fd5a6868efa9b77bea0051069bb67367ca754e0801de971e7a31d1ccadd44dbe8a4fd71d12f4dac97375aacd0f51f33761ffe9c9aec19e956e260e71997503c05c5540f7c1836c5e395c41de2dc50aff3a9887a801fef5b4000000035e532babdb49b6f77656989cfd98dc398145cf16c470a4d53763896107773764de81713d6b62347a418ec0240e2f09641bdff0431adf74e5179261b0e9ccd4f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1460 iexplore.exe 1460 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1460 wrote to memory of 1756 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1756 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1756 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1756 1460 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://match.deepintent.com/usersync/1411⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD544a01a23d04b13783e225e0958e677c4
SHA1c0423cda929a0caa5378500ae57e4a49f0835dca
SHA25690fbf0a09e5cde4b53479855f3e6fdacc5846e6b26ed012c7cc48737aba7257a
SHA512b55f42263c43ddb126e1be9eb627d8f6ef24f2e7d4f31c5aef269c9b708e016b83f31b838098aa5b82692573eb3889d357d4246f03d337f95f014c1e1e59bb0d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WKHAM9YV.txtFilesize
608B
MD559985d29b6e92e41efa62bfdc23d5024
SHA1d42851e8e8c1a00aaf84207a3d20f79cb26a8efc
SHA256e9ca743f2a1a4baf7b279125089bc400f1859cecfd1924d4e9f75c1501a155a0
SHA512a7ab19bed15ce7564361f01ee36752f624e64c6b0876164aad71607577a43f67176cc9fff7905c9dc81be24f2d9b543759478434fce8c37aafd3703c1c466757