Analysis
-
max time kernel
146s -
max time network
197s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 09:41
Behavioral task
behavioral1
Sample
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe
Resource
win10v2004-20220812-en
General
-
Target
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe
-
Size
654KB
-
MD5
21e5f98f6e9c9a5aaeeb659a8f913930
-
SHA1
2fc4897c0a9ef31924964c559bbaa9f81af2add0
-
SHA256
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58
-
SHA512
6927850a94786c678a382a6055a64ab0f9be4267429d85f80fc35ff0351724e1d97d57471c9c277e60721676e3e2d29a7f4fa9a42d6a4a5efbd4a5252c4a9a21
-
SSDEEP
12288:XJr8CrW1KuPMnZy2hWvG/Mx3y+eRAaWdlZFatVVE/cKlR5A1Ks5Su:ZrVrRuEnZNhqQMde1QFok3yKuSu
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1584-55-0x0000000000400000-0x00000000005F4000-memory.dmp upx behavioral1/memory/1584-80-0x0000000000400000-0x00000000005F4000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeb66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exedescription pid process target process PID 1584 set thread context of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 set thread context of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B75B9D51-720C-11ED-A8EF-5A9C998014C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000007a6a75d95543c988621e96f391366a921ab7a1672c3c385dc3ea05420e73c5fb000000000e800000000200002000000055311b1217ed4ab37a551a367f21d00896717a70ef9114624b7ec826d5db784b20000000c450a5cafcabe14510ba49fcd380980ae321366624ba5ee726b1e2815105870240000000b058e57f94540137ef9f25a3c76ac4305d74e6b5210c9a8222b7e5fa6f5c3a3e1475462ebd837a930baf79c024dba79f135f4b58bfa13a78dcd82aafa154e3e7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000aa3c3f167114e9b47100f8dd2e5a866decddfb5bbbf744acc82e1bd238f92efa000000000e80000000020000200000003e0a660b08592c52c1047163334843ad07aacb914d5c255b6a15ebe658d02514900000005e6a119dd9e5e3a931dc764c8a849c0bf3f2395abe6beae91487a5192d4376995302255246d6fe59e2bce7aef275ebeba4404b58e07d49a17a7b460854126151c43a389896e20c8328122094e0bc3867017d0a272bdda089c34912a7179fe27996999291047503d6136c0d029d1ef2d0444ab5298fb6ed8f016227d9e3ee044205358a97594a8a8129b506c77c36865b4000000012fed54ba848dd1a38e97d252cd5a1631edbfdd0b75cf16a8e7261935ce26aeb5fbab5274cfe0425ff38bd0dcfb75583c81067a4ac1b44e103f52dac154739c9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0376b991906d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376728421" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 676 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeiexplore.exeIEXPLORE.EXEpid process 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe 676 iexplore.exe 676 iexplore.exe 964 IEXPLORE.EXE 964 IEXPLORE.EXE 964 IEXPLORE.EXE 964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeb66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeb66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeiexplore.exedescription pid process target process PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1584 wrote to memory of 1452 1584 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 1452 wrote to memory of 328 1452 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe PID 328 wrote to memory of 676 328 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe iexplore.exe PID 328 wrote to memory of 676 328 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe iexplore.exe PID 328 wrote to memory of 676 328 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe iexplore.exe PID 328 wrote to memory of 676 328 b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe iexplore.exe PID 676 wrote to memory of 964 676 iexplore.exe IEXPLORE.EXE PID 676 wrote to memory of 964 676 iexplore.exe IEXPLORE.EXE PID 676 wrote to memory of 964 676 iexplore.exe IEXPLORE.EXE PID 676 wrote to memory of 964 676 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe"C:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exeC:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe"C:\Users\Admin\AppData\Local\Temp\b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b66fc784b48d0bba31cd52972d7bb8309ce51319ad33c28a88441d646e139a58.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.04⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:676 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EYF9VEEI.txtFilesize
539B
MD5b7ef19ddcb9142903336e57ed1a538c7
SHA1385d85ec1f1a8aa19144fa73c56bd89748f4e8a9
SHA2569663f736e824af4e4c91eb0cfc6501a8bfffabb4ff700f5fb42d5c5665580cc0
SHA512c926cdb446e74b90c729964c5b6b3695b2ce0769ea3a3856c60681e0c360e03857a5727812b5cc6b1d8d5ba9dac2bb6c5d22a17a89f61eac5c69f203df2e0d67
-
memory/328-74-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/328-75-0x000000000040C52E-mapping.dmp
-
memory/328-68-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/328-73-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/328-71-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/328-77-0x0000000000402000-0x000000000040C600-memory.dmpFilesize
41KB
-
memory/328-78-0x0000000000402000-0x000000000040C600-memory.dmpFilesize
41KB
-
memory/328-69-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1452-64-0x00000000004010B0-mapping.dmp
-
memory/1452-57-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1452-59-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1452-65-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1452-56-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1452-62-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1584-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1584-55-0x0000000000400000-0x00000000005F4000-memory.dmpFilesize
2.0MB
-
memory/1584-80-0x0000000000400000-0x00000000005F4000-memory.dmpFilesize
2.0MB
-
memory/1584-81-0x00000000031D0000-0x00000000033C4000-memory.dmpFilesize
2.0MB