Analysis
-
max time kernel
813s -
max time network
647s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-01-2023 18:14
Static task
static1
Behavioral task
behavioral1
Sample
SoftwareSetupFile.zip
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Privacy Policу/AppXRuntime.xml
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
Privacy Policу/AuditSettings.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Privacy Policу/en-US/DFS.xml
Resource
win7-20220812-en
Behavioral task
behavioral5
Sample
Privacy Policу/en-US/DWM.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Privacy Policу/en-US/DeviceInstallation.xml
Resource
win7-20221111-en
General
-
Target
Privacy Policу/en-US/DWM.xml
-
Size
4KB
-
MD5
8c0c1f2ac3237b8aa71f88a5650c0e68
-
SHA1
8a39fc535339841cc7573b1dcff729cec8e54114
-
SHA256
844bf77e54e0c353537b0d1349f0173049dd36c0cb64eaee900663cd0a227ab4
-
SHA512
c6f8ac395d011ec45ebf47812ebebf7e152db6a943566b744aa83b22529df07e3d0749d008b5f3a8a46953cccf39305966869e5efe502b1e727cf55ed7a05f4f
-
SSDEEP
96:LeD5pm8i9yPYwH70day2JGkA5mZAOtfMtlV:E1i9Yn0zMA3G6
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e18f29b791a75442a0f2bfae6a5a0b6c000000000200000000001066000000010000200000001a392e4c6ba7205d6feece58762b82a5cd66f70ce85757a21147f2b7bf965761000000000e80000000020000200000000fdb17d4ba811fc443708250d9c3d510e0f21d09e1ac35e0f186bb4250e18a632000000092fca306d30dde357c5448c37f9ccc5fc0be7d1e97418d24ffa55dea076c052d40000000dee41292a9494feeef525a03449a78001342e4afe4860beaa9639e9fe6351158d8e67dedded84906f90199766f8fe4c75a1f8f5bbd52cde25e1fcc456368ee12 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379538425" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e18f29b791a75442a0f2bfae6a5a0b6c00000000020000000000106600000001000020000000ee6fd66ffa0098e7e928bc67913edc1df27b11d891ff654989cd027a87339500000000000e8000000002000020000000f7992eb451b2c3f51178196b115f99573a2dfba2d1bf0a9d9c2661b940ae786f9000000003614453c79ca35531410b22c8face97222f4e04be94d01e5dc6a979a0ea2dc4d63fec11019c8ceded985fe8af168ff30e0111ee35bdda35dc6fb97ddf558c1e2435870a8eaaf9bf664e7d37f23a9bc505616db2cc138e48e905f266a592e4fd886e1944c7ccd4132329a1d4d2bb4b906766eb3276919a48a2919cf9c8bfced5c4eed6d66c3dd0ec11e796e2a51a91dc40000000f128e9afd7702f64eb90325b6f2fb12045508687fdbffbe0b9098a6def871b550c04ffbfd163bde5329bc97fb879cbe5e03c733a41d165e8190fe8994345393d IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e3b715a81fd901 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4041B851-8B9B-11ED-A94D-C6F54D7498C3} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 836 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 836 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 836 IEXPLORE.EXE 836 IEXPLORE.EXE 896 IEXPLORE.EXE 896 IEXPLORE.EXE 896 IEXPLORE.EXE 896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 548 wrote to memory of 1292 548 MSOXMLED.EXE iexplore.exe PID 548 wrote to memory of 1292 548 MSOXMLED.EXE iexplore.exe PID 548 wrote to memory of 1292 548 MSOXMLED.EXE iexplore.exe PID 548 wrote to memory of 1292 548 MSOXMLED.EXE iexplore.exe PID 1292 wrote to memory of 836 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 836 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 836 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 836 1292 iexplore.exe IEXPLORE.EXE PID 836 wrote to memory of 896 836 IEXPLORE.EXE IEXPLORE.EXE PID 836 wrote to memory of 896 836 IEXPLORE.EXE IEXPLORE.EXE PID 836 wrote to memory of 896 836 IEXPLORE.EXE IEXPLORE.EXE PID 836 wrote to memory of 896 836 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Privacy Policу\en-US\DWM.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MYH6DSZ1.txtFilesize
603B
MD572bdc51a797f948f689e7f5512d407fb
SHA11697668a2a9bf08e29763203934468dba88ceacc
SHA2564e4e8e748f50546b618a93d0cf851ba9484c9c6d91daa8f0c03ceaff67ff049c
SHA512798fca43de09605aa65e8ebbf2a6bab389f79792f24a3a630ee28b37665fa15a7df94299dbf41a87be001a55d618a7fd1d13db3b74d284680c7a78da9e24e152
-
memory/548-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB