Analysis
-
max time kernel
184s -
max time network
259s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 18:34
Static task
static1
Behavioral task
behavioral1
Sample
e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe
Resource
win7-20220812-en
General
-
Target
e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe
-
Size
1.1MB
-
MD5
ec58c26cec37213e57c29de9d8451b7c
-
SHA1
17a4716813deefd50455df90995903f252e78b40
-
SHA256
e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f
-
SHA512
d15c6ee65b98dfa561de83c58a4ee53f29ce55f9e76ad681659a4ba894c992e7749501eb89730fb89bcd0628c57e80764d9a145f9227646f93f7a29eeb407510
-
SSDEEP
24576:szYXUL+lJupqdJNTisqTzWsb7Zz5v9ROa//ck62H82:FkL+VDPyisb7ZVv0k6B2
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000097c5fba98d32141a5ebf5d3d0e1d29600000000020000000000106600000001000020000000faea5502c6c0f225593f2d309f7390c9b3a86c31d5aa52247fd2b68c7d48ddb5000000000e800000000200002000000027ab95e73f57628732602f2273fd072e316a628d35da4a364cf5e81276748476200000001ae00ff33446a2f090b2aff52a2af5b7ab74f8e122633570ec89e2da93c070c34000000049a9361538356a525b232497763cc341a27536ae51857f5ad753ed72e0a76e18d651a2939786ffd0a79d31d5e76553282714beee1f9b219086b1fa1b0941cca5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0092f6dcce09d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D60B2551-75C1-11ED-8F62-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377136082" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000097c5fba98d32141a5ebf5d3d0e1d296000000000200000000001066000000010000200000005c6cc14d91892e71769fa2ebb8924caee51841a585165eea7410c584a40a80c3000000000e80000000020000200000006de626b576ebc4bb6fb361d658672dceb0f3ce9d4c58f7740d80238b49c6a42d900000009fd6fd99f7bd2c3679d1dae0f8001b58771115249711e77c72b53091526c56a15a402267c08f22eeeac89449a95023de3ae8a077b98b6897074083cc074c3340aa234f16b8c463a80ebf5b904071de61b0c0be092d80b38687a80cb5fa7df3e6d47ada3b7d589b59eb8ad4879d614cf01c7f76c4588de938498bffb247856b7e63f1ff07328d9ec1a87554e0c7eb850c400000007258e32c579fbf4263a5aaa644c7ffee11ff0c7386b8ffb235839ed0e5e858af455199eff31133a87d1c97a9a549d6649ff46d596a5c864e692142084f191082 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1112 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 948 e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe 948 e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe 1112 iexplore.exe 1112 iexplore.exe 824 IEXPLORE.EXE 824 IEXPLORE.EXE 824 IEXPLORE.EXE 824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30 PID 1112 wrote to memory of 824 1112 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe"C:\Users\Admin\AppData\Local\Temp\e278a2ef0201e8b8d2de0173af91aee7a04a6caf8418c38e1a885d177801ec5f.exe"1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:948
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:824
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD55e4fdd20671a70a46c3898f4a5363fb3
SHA1b461ee62dde539a0df6d79f580f821006ce2b837
SHA256cbe298cae462b0122e222b6765e771d91bff4cd94c9db844416bd756485f119b
SHA51245579ea938bf5b8098f59c8993a9048fb748d6bdd903b00a2cdf868e9e1856458cf4e78b982033d59a9d350c2aae4141070d7e03092dd3c7f5b8fc40b3af7311
-
Filesize
602B
MD55015c952244dd1a2eeb778ba842ef423
SHA153fa7c81fe528096e71bb51cf9d88531d3b00a37
SHA256aaacd7e1efcc86dde4217b3d6dea0c6ca77663606157b22391bd8f64f5381b24
SHA512279ff38aeb8086aad817304ab444ec2eb3545e903ce554b190b01876869260b5bdd220747d3c764c56acb6af4775a404e370b1ff1c4d71f8f2736a128e04e88a