Analysis
- max time kernel
159s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/12/2022, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe
- Size 760KB
- Sample221205-zmgbsshg9v
- SHA256 e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069
- MD5 88ae847b4d5dd265bd64ae44f4b99c68
- SHA1 dead24da2d4fb0032ff33a8922c17b8d2d541112
- SHA512 29e69254a7983982dae3cbaeae4a3aee6501954cdd089b29787a4776d2f5611f1830e130bed0d4eed114065de8e9baae118ec66959f3bd1b77f67771b32093b2
- SSDEEP 12288:stlYXUvTmeFyq4kp74RVLlcMM23FYBNMWepx9hLlK9Iu0wbGBtNsTmUMTxLoDhNU:szYXUvTQqZ78G4FY/eDqIuNiPs6FdMDY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377421857" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "272682503" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c12361c0152227449267ac11601c0f9d0000000002000000000010660000000100002000000033045dd7c7e42a881b04cb3a1d30af49b8b8d265f4b01f038f89407c6458a4e4000000000e8000000002000020000000907604a629feb3656335002492da1c2fbe21218331504bde8d66be87343a155620000000bf1b45529aba2e0308b4eab67073b8f36802a413288e25eaa23c8d04933075df400000009aabc11a038b3f0da0b209982db33f6475a70ec57574491ddad3428d2757232baff60ed62c6d7e6b6465aec19ff20e22e277458d1943e8e0fdf0ac4224fd2280 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "272682503" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3B34F4AD-785B-11ED-89AC-72E5C3FA065D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001704" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001704" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c12361c0152227449267ac11601c0f9d000000000200000000001066000000010000200000008a19b2bc961f46f70d8c42a4533a9c3da7a9435917975a516211f88adb6697a6000000000e8000000002000020000000787d5021895845a3d4b5af42cdfa8178c46594cb6512d492c6d96868871e948a200000005cf2304ff2b052d966140fe78848c1cc1cbd5fc02c43640f6677f5cfe8e4b7d6400000001f3ffeafca766786c058cddb020af9c65a5f83df9e71b0f7022365f7d04e749aaec9d60c228428b8336366c3342566380c1f351610dc3f1881e91f9138e18725 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f71827680cd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005e3d29680cd901 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 308 iexplore.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2256 e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe 2256 e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe 308 iexplore.exe 308 iexplore.exe 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 308 wrote to memory of 3796 308 iexplore.exe 85 PID 308 wrote to memory of 3796 308 iexplore.exe 85 PID 308 wrote to memory of 3796 308 iexplore.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe"C:\Users\Admin\AppData\Local\Temp\e3ddd498cdde0959183d3890dd19eec974aab2292f074b4dc05b011b917c5069.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2256
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E} -Embedding1⤵PID:208
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat
- Size 1KB
- SHA256 6b45ffdda3a04085b2cf8daa5e6141ccc47f7d72bee2e51de13c5e31824a6a2d
- MD5 0959a74f0985ad036b3ed64286d36876
- SHA1 655d53f4ca50de71383be67110bf8e650ad50bb2
- SHA512 5602e1098023a99e36fa11594e65906e5a285ec3fe43581bf3416dcd7d938645da7253b0a45ecc859d3c48cfe7c40a6e757c4ae80d101c65964e8315efa1a356
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMQ6XNBF\favicon[1].ico
- Size 1KB
- SHA256 b34cba01e546edc251e36544c5989aee04221f3f05db2edb51ba97a5b9b1cf7a
- MD5 291530f9b085527ca937426337991f79
- SHA1 67714f3578da3efbd612f757d041cd29a6c605a1
- SHA512 6ca95e43157d197c095310c94a60d5051cac2da0c0c6c10f41301b8a3ef2dc94bcd4eae1cecf311a4d47666a470d74be8962d5ef6bf386af0acb300b42a38d5b
- MD5 SHA1 SHA512