Analysis
-
max time kernel
92s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe
-
Size
1.4MB
-
MD5
1dc23488e0136f7677cee72b9f8dce20
-
SHA1
e6495d6ab1234c50755ba52db8f2b3f1b5832724
-
SHA256
d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14
-
SHA512
23f383a869cab16a5d96ac78cf964861e045f132e53ba597cb821a8e3db9a04e8f37642e34170d442da240529de104a06fbd9761f91cd8492101b224ed2e53c1
-
SSDEEP
24576:GzAuqswf7i38I/Cpz7v/QEmBIaHl39JktiQjCbaxd/zcF4Pa0/rQQx+J4veZ0a8z:lJiT/ofnABIaHzOiICbqzcF4drp+WZxz
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b0ead28e0ad901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000030c48c3c61cd41b1beec83fbcd093600000000020000000000106600000001000020000000c4f3dd8bc9d9af3de4102b5b713b35a6708cb48289e0b55f08afdd954785015e000000000e8000000002000020000000ec369afaf76062f3f239fbbcc2ab104ad582e18e9c4fd8c05ecbff6daa644ad490000000e9a598433cabe53e60b437814e070c94d0e5913ef45a5dfff464944fabae4360dd873998ccdfc4f6a0b3c5e34efa505fbccdc5e4e1c1f37ec410274807f972aa9ea8c0b5f03502a7f3899a7046afedc135e90b8133cf3b6968bb778c24f253cce10b1a09a66fcaf43d97dc11a5ea8e739789af56f4bbad60fb25da35b118590f484977690205c33f6c57871021ff60a640000000b511b0d69bf73f116f3d8c959c52886accfa003fd77421781db3be6159d08880c7fa2bd4b835b964fda8b90a5ab426602e0a4d059dd9f2f4d8e3c12ecc9a7ce7 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377218547" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DACA1951-7681-11ED-A064-6A6CB2F85B9F} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000030c48c3c61cd41b1beec83fbcd0936000000000200000000001066000000010000200000007d042231e7b1727a50cd175cba304ea6507c699f420f3f2c1474ea5745e31f6c000000000e8000000002000020000000f46d002be2290b50188ac2dc4796923c9f98a86a7a85ed989a055ca60cc366b420000000a0d44ea74e46a56670c049015efebcda0d8df2dc285a9370649fc5801771b01d40000000ea00042a0b161118e53e91a44cbcf1d2fed3e144d2a4932319e0a777a57a1b66b90c2a990bc72e9336f72d63ff838a493c558d8d5fb11d2c825878a39903b745 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1368 d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1620 1368 d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe 28 PID 1368 wrote to memory of 1620 1368 d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe 28 PID 1368 wrote to memory of 1620 1368 d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe 28 PID 1368 wrote to memory of 1620 1368 d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe 28 PID 1620 wrote to memory of 1680 1620 IEXPLORE.EXE 30 PID 1620 wrote to memory of 1680 1620 IEXPLORE.EXE 30 PID 1620 wrote to memory of 1680 1620 IEXPLORE.EXE 30 PID 1620 wrote to memory of 1680 1620 IEXPLORE.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe"C:\Users\Admin\AppData\Local\Temp\d5fcc4ad2fd2d4c85ec96be046a969b7862dca282b93b0782dd6e691854f2a14.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.a585.com/?down2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604B
MD57843f50b49efeb8ffb302f97fa6a8bb3
SHA10576b3c6b15804b0bc1be52cea8284ae33fc1e2b
SHA2564014f2a3f20485258d515bf24ae29b6d9b51e53247b7d402ec9e81d2f534ab6e
SHA51210893efb126d13ba05e208b5739f07e3012e3f311e59fb5caaf3bb82958a7f4cf3fadccbe27ee32afa408273970097c1dfcd086d091f79ac0b352abda96ce762