Analysis
-
max time kernel
79s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 16:45
Behavioral task
behavioral1
Sample
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe
Resource
win10v2004-20220901-en
General
-
Target
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe
-
Size
85KB
-
MD5
eb3f29ced2dbc130c73a8382c4df22a2
-
SHA1
6a9fe8c6c24f8cec5f0655871452144735469a74
-
SHA256
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3
-
SHA512
91452af8efe04651f6729150fdbd56c28819cbe063636406808b742a868d77894fd0a018a43abac039397ca163c2d6f8eb415990fa096746ccbf1ba7059f5114
-
SSDEEP
1536:1CRkOyEArPjZ9g652xtZGTTkwLoIXXmKg5Ez04lqJLseLJefYVt5b9BDZprk+YDq:1UPd47gYMGnnLoInmKoXF5LJeoLbPZpD
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1976-66-0x0000000000400000-0x0000000000447000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exedescription pid process target process PID 1976 set thread context of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803f64253605d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007288c158b3bd0848909aabed67955a0f000000000200000000001066000000010000200000003fc35ed437226aa2c268154ed408ff5a354f1ccd12adf3adb0f0c8edc46c65fe000000000e8000000002000020000000960b2f35e9f2ffc297c83688b64965d942c109f8e18c31530cbf7933745d4d5720000000dd79c0dc20ecd6e2b721dae04639f1f52caa772646d2a3f77d66bdedfb6a0b8d40000000ac22a62288b5582671cd69bc232aca77a6b496f7a55b860807c135440ec42c99c41a3ecc8982762a34eebd509ed5f96c89be9bd595201e5cb84342d77e1595fc iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376630719" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007288c158b3bd0848909aabed67955a0f00000000020000000000106600000001000020000000fa8d4d7c315c0435a26f506485700e4aad7ea436b84468b6a946f302d1f66da2000000000e8000000002000020000000aed72d2a46a96cfad7f3f49e6b52ca8775b42697749aa429df644b0dcf8a7caf90000000647b38317a4153f1463696a098e75ed8f0a24181eec1ec626323f1bc41517904b96243302b2120bf856ab8a36b294ec0a5a0d8a87a08bf1afa9554f134ab3771907030919d581ebd4f959188fa0ee98f070bc4f1e25bdf3f1a76afc58509228c852412c48ac9b443d9581dc5059addb5bba44979507bc21e9af09b84f9f7a0994e0c365ec6507aaceade214d1a2882ef40000000d40aaf2180dca316c2b6df81d7997daebb58ba31804b5e81520548908ceffc628b7991a410ef382efbe5b5fa2307145e7b67ba597673b2611be063ca14ec278c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B213801-7129-11ED-B2BF-6651945CA213} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exeiexplore.exeIEXPLORE.EXEpid process 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe 1368 iexplore.exe 1368 iexplore.exe 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exea7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exeiexplore.exedescription pid process target process PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1976 wrote to memory of 1524 1976 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe PID 1524 wrote to memory of 1368 1524 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe iexplore.exe PID 1524 wrote to memory of 1368 1524 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe iexplore.exe PID 1524 wrote to memory of 1368 1524 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe iexplore.exe PID 1524 wrote to memory of 1368 1524 a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe iexplore.exe PID 1368 wrote to memory of 1204 1368 iexplore.exe IEXPLORE.EXE PID 1368 wrote to memory of 1204 1368 iexplore.exe IEXPLORE.EXE PID 1368 wrote to memory of 1204 1368 iexplore.exe IEXPLORE.EXE PID 1368 wrote to memory of 1204 1368 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe"C:\Users\Admin\AppData\Local\Temp\a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe"C:\Users\Admin\AppData\Local\Temp\a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a7e385cab51b91f2beba9cef83ad698adf54ee4ee0ee4131bc5bb648f0cf5be3.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W0MGVRJ8.txtFilesize
535B
MD5d45ac35d89f10280fea8e99cccf6e76a
SHA1df661b725f8eead960883dc75768e893b9abbb72
SHA2566e591641ea7b6b76b265d4c4c79f23a6d16788a4ff14d6694599e7c4148a8e1e
SHA51239ddff876fd3e73b245e130b65107fbaa23f3b4db4abf0bd8f8db41b3663d3947a7a85d0fa23acaf351accc9850096646e89d392471b8c2cce9942287f3382dd
-
memory/1524-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1524-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1524-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1524-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1524-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1524-62-0x000000000040E792-mapping.dmp
-
memory/1524-64-0x0000000000402000-0x000000000040E800-memory.dmpFilesize
50KB
-
memory/1524-65-0x0000000000402000-0x000000000040E800-memory.dmpFilesize
50KB
-
memory/1524-67-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1976-66-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB