Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe
Resource
win7-20220901-en
6 signatures
150 seconds
General
-
Target
c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe
-
Size
212KB
-
MD5
7cd2e89143821377d1b52f945bb362ab
-
SHA1
9217a7b00bfb4a0574fd1d39904bfb7376d47fa3
-
SHA256
c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c
-
SHA512
fc093f65eb07ad9a493c54088cf69803c62203b284a263ba6a9d3d9b2736a11427ee469a93c622dc5c911e96ca7c511722e6597d88d315cb7271c3f0477422c0
-
SSDEEP
3072:lz009e5wvZxLU699XHrZAR6NOB3gQYbRWhOZ5PYt1EO4:lgG+yxLL993FAINOBrYblYt/4
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\Enabled = "0" c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownVerifyBalloon = "0" c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\PhishingFilter c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9C39C47B-7659-11ED-AECB-C264E7FE3618} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1897564245" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001190" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\InformationBar\FirstTime = "0" c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0127b7d660ad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\InformationBar c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dab17d660ad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000062f83db2769fd4595e8dab083321d190000000002000000000010660000000100002000000074069aa586483ef853617ab2af3b5ae2d961da52a2c193fbbc8094a4aecfcf94000000000e80000000020000200000008da57c3aa62b6126edb009f09edf2f0464c935a2810be0571f1b42a8cc45b50720000000864ca62b763c77df9cdb9fc36b11ffaa6b4fe060a08f6fcf5652e6d20a6c2bbf40000000ae86def632cdcd3e288005321e5680b47cbbe32716c51c4daac5ce7f2040a7ddc27121d21996f887daf248a4cf25eda0f2d2af0e5f18686b991085430de6a871 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000062f83db2769fd4595e8dab083321d19000000000200000000001066000000010000200000002a8c15ee65b6645a000781b0fd550f89329e65587416827c6707a5f4346a516d000000000e8000000002000020000000ccbebc943e9d5adf3028032b4b79a84d6cfa615c4cd6c7665860d28338e1a665200000001c80076b3ec929f41886263385f72322e6e82c84e52af4fa9e08e698ad34e93a400000009ba0aa8891f29de6bff22d4b4df15bbc6435c0cfb9091c7efaf879bec7913d334334890710381d4a6c4c0cb4d96204a0be3ca5d3e82d773889bc6ce2448d7aff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1897564245" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001190" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3768 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3768 iexplore.exe 3768 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2712 3768 iexplore.exe 89 PID 3768 wrote to memory of 2712 3768 iexplore.exe 89 PID 3768 wrote to memory of 2712 3768 iexplore.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe"C:\Users\Admin\AppData\Local\Temp\c27e34f6628693e0138ebe6c25476b4519a19d62f276eb9eed7d897625d5004c.exe"1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
PID:1788
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4036
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-