Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe
Resource
win10v2004-20220812-en
General
-
Target
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe
-
Size
431KB
-
MD5
4ba2a6b084531f18618e9dcf0c0167a7
-
SHA1
26034520747748d89c525ecb2b0ff8133a19524b
-
SHA256
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1
-
SHA512
1332b5e06cc0c3c5d6734a7c3dd8e138b168145ab1ac091e996d6cbd8174130a6aaa5d4ea7a460cbfe9afaf3d6af9001ec03615caf42586997937a476d5f9064
-
SSDEEP
6144:BcotZ5JXEufZNOwQj2HgBAf/bflYBMiFWMF8P05V5rSdZS/bq:Bc+zJUuxNHQCHgu/bfniFnqPoVSQ/b
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe" 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe -
Drops file in System32 directory 2 IoCs
Processes:
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exedescription ioc process File created C:\Windows\SysWOW64\runouce.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Windows\SysWOW64\runouce.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe -
Drops file in Program Files directory 26 IoCs
Processes:
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\7-Zip\7z.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91BBA091-71A3-11ED-AFAE-66397CAA4A34} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ad8476b005d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000343ea3eb7aeb7d41bd922d832aa0e8ec00000000020000000000106600000001000020000000f3e55625b1fb560a83e67e5308882cc4e35cc6b15bfe2d054505c7433b2a221b000000000e8000000002000020000000dc02126ef96bd49fe89beb57290d30ce0fac9f1154e6f6f59428cbbf9984b15590000000370333f5a57f393ee6c0b80d38c0044a95aaf4bab408f79303c162f5cea1cf0449604b5e30a6e76491c6ef29c1f8468b71e51656881e225b4326819e1e87fbf4d176a5f2ddb279b2899ca8bd797eacb09f5f7aa3aa36ae2b2cbdf5fcfddd48985c81888524f59e5244c33ddd05fa781a4dcde4fb14fce1e1868f342d876631ad1e3d5baba6e6017bad6308884732d27c4000000016c757fa0880acd61bdabb4cfdab6de0025f6d16ba85c7fffd29dd6db10cc279cda71afd7f11831bd44e8b67a9ac2fe8a341ac0ec5449d494016402f0b80ab22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000343ea3eb7aeb7d41bd922d832aa0e8ec00000000020000000000106600000001000020000000d197bcedac09e42f4e4da7c022a77adb6f62d67763ba07aec1641ca35dacc70d000000000e80000000020000200000008d4e9f163b5e6589d2b7a5a05a9bdf0c3c1a6b32aa0748024d313cb74188a2cd2000000000968d78624c36e21dc4517932cb8ea2dcbcce11ee42aaefe8af2b1fdff1922740000000e067bca26d778bd329a9840e585b6cb636771f43605f9c8fa5d86e92129e9094c73b199926ddb1277c4b21dd885d310178c7e6637bad44bc8a90d753782616d0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376683261" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1756 iexplore.exe 1756 iexplore.exe 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exeiexplore.exedescription pid process target process PID 1996 wrote to memory of 1928 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe PID 1996 wrote to memory of 1928 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe PID 1996 wrote to memory of 1928 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe PID 1996 wrote to memory of 1928 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe PID 1996 wrote to memory of 1284 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe Explorer.EXE PID 1996 wrote to memory of 1284 1996 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe Explorer.EXE PID 1928 wrote to memory of 1756 1928 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe iexplore.exe PID 1928 wrote to memory of 1756 1928 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe iexplore.exe PID 1928 wrote to memory of 1756 1928 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe iexplore.exe PID 1928 wrote to memory of 1756 1928 70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe iexplore.exe PID 1756 wrote to memory of 1236 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1236 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1236 1756 iexplore.exe IEXPLORE.EXE PID 1756 wrote to memory of 1236 1756 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe"C:\Users\Admin\AppData\Local\Temp\70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe"C:\Users\Admin\AppData\Local\Temp\70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=70e398724dd582c31adb2bc107e47ea13dafa40917cf031d00e029f8444794e1.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.04⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OX12ZPDY.txtFilesize
608B
MD5b2fa827c71fe32279f7212add0f5306a
SHA1b969befc92b281dcca045783bbc1c422eb3e0a69
SHA256355747cc784c09c9a31ea977204d395725c7b8528cbb88e1d1919c230136ccad
SHA512d6bbbad5ff4b128589557ea97b7bfb879b85ff0d6ec25d65d7dbdbb3022a9d53d2876bdbfdc60f00d490be164e68c931f9ae10d6e45f012b2002a47b57c82ccd
-
memory/1284-55-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/1928-54-0x0000000000000000-mapping.dmp
-
memory/1928-57-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB