Analysis
-
max time kernel
121s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 20:45
Behavioral task
behavioral1
Sample
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe
Resource
win10v2004-20220901-en
General
-
Target
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe
-
Size
218KB
-
MD5
ea8bc532fc445aba6da82d821e89e28f
-
SHA1
d1fa928c07fd5bf8554d5eaae33140862e6b79d3
-
SHA256
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601
-
SHA512
fb4a7880c6b9f038d21d32ac7aea003b46a3087cc783170a37d0ab56bf1a2f046f3a3d565484888d2e98d9ab623138593abd23df72b392d4ea24d220047e731e
-
SSDEEP
3072:mN6jJE4iM6wsdPLGBG2Ox+7umxab8SbNf1KeY90RnEzb9InSEHD03ffMsd1PV1Df:Q6jJ3D3MGBG2F5AKeA0SMERV1L
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exedescription pid process target process PID 2012 set thread context of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d085c4049507d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000689683dd6e21354199df05f8e38d744b000000000200000000001066000000010000200000008f7a3b5c01cb6bb0b72a9026d75aa5d887338afd639fefb1756804ff8be82481000000000e80000000020000200000002245f02b1dbbe2d6e73a9c088d9e7cf27f5706f1f1c0f72b14390aec14d2962e20000000b9bc965636bdfbc0457d269df3c1f4519ae32e6de3bd20a2a6c884d8b4aebc2840000000718e7af0199d421822df49be39191fac18460df445a7a048ff37480665f8af6dfa5a371ec19ed3a7d39b94cac24ec8022bc6919bafae701750354285b4cdf88f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DEFC241-7388-11ED-A503-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376891384" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000689683dd6e21354199df05f8e38d744b00000000020000000000106600000001000020000000e91ed5f5d5bc1806b51f03de70f36b2f468fb4301e64c85c528441b57c68352d000000000e80000000020000200000009ae5560ad1aa5a49122049106269a7a1be9e01d8a7cc3566f36284834741462c90000000addaeb1fa0823b0163fac0cac589dfc5680c6934e7e2cdd298c3c83bf6a3b4284ffe9487b991f99cebae6dcba449e19d23c16e353f904b7f0bca898225f4554fa466f424ef417656c3ed5d69cc780843795859f0a0b0fc6a8fc3d011658a1867edeac7d82bc8469398844c902aa089c67ecf0193e2ee027acd1ac40386ea5c847fbb63af3bf93ef4317c98b0a9f472b2400000006367459bff14dd73d65044f1e00e8adff7696efe36f753bff1a15e2aef82a6d36d4c7a85c66b53dfb75e9fd141397f2ca88bdcf9643f3416816bbbf3a6b7a8c3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exeiexplore.exeIEXPLORE.EXEpid process 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 1684 iexplore.exe 1684 iexplore.exe 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exeiexplore.exedescription pid process target process PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 2012 wrote to memory of 1452 2012 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe PID 1452 wrote to memory of 1684 1452 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe iexplore.exe PID 1452 wrote to memory of 1684 1452 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe iexplore.exe PID 1452 wrote to memory of 1684 1452 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe iexplore.exe PID 1452 wrote to memory of 1684 1452 9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe iexplore.exe PID 1684 wrote to memory of 1204 1684 iexplore.exe IEXPLORE.EXE PID 1684 wrote to memory of 1204 1684 iexplore.exe IEXPLORE.EXE PID 1684 wrote to memory of 1204 1684 iexplore.exe IEXPLORE.EXE PID 1684 wrote to memory of 1204 1684 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe"C:\Users\Admin\AppData\Local\Temp\9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe"C:\Users\Admin\AppData\Local\Temp\9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9792f205964083e622cb09322f9e1a321af1f508af750da9d0f0e2c4ab1e3601.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\39TYNJWI.txtFilesize
601B
MD5caaedfcfa902e059355db256ffdf5199
SHA10a44172c8457ab5f8cdeced1cb4d4e129842ccf5
SHA2563c54d9786c0af09ff729e1597207b890d32caa3222b278ea10e36f02ed1c744a
SHA512efcba10336cc052596dea104736ec3fe7e38212480dc5bfce724d6d4a7774a7e34ab378b5dec88ff116a93d6a1cc25b3a72878714a5f875bfde1e860e82a1c77
-
memory/1452-64-0x000000000040877E-mapping.dmp
-
memory/1452-67-0x0000000000402000-0x0000000000409000-memory.dmpFilesize
28KB
-
memory/1452-66-0x0000000000402000-0x0000000000409000-memory.dmpFilesize
28KB
-
memory/1452-63-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2012-56-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-62-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-59-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/2012-58-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-55-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-57-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-68-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2012-54-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB