Analysis
-
max time kernel
132s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 12:28
Static task
static1
Behavioral task
behavioral1
Sample
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe
Resource
win7-20220812-en
General
-
Target
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe
-
Size
196KB
-
MD5
8638468be18f63e7190d6855c51e9e50
-
SHA1
508ae3e49b8c8f3d82df2a6f132863a3d995a274
-
SHA256
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c
-
SHA512
5f8017f6a188ce898316741e700f77d4a76b0895fe556862d29837c29ae83ff50ec22ce19f23305854e77796400fdca3a76d81e01ee06ee03b05c515dca21134
-
SSDEEP
6144:mY3UEJ5yEMbOR/BV7mNwrTrP9TE4qyEyIQ568:3FtR7AwrTrhZEyR7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1952-56-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/1952-57-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/1952-59-0x0000000000400000-0x0000000000496000-memory.dmp upx -
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381763924" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0020331-9FD8-11ED-9843-7ADD0904B6AC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exedescription pid process Token: SeDebugPrivilege 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exepid process 824 iexplore.exe 824 iexplore.exe 824 iexplore.exe 824 iexplore.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 824 iexplore.exe 824 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 824 iexplore.exe 824 iexplore.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 824 iexplore.exe 824 iexplore.exe 824 iexplore.exe 824 iexplore.exe 896 IEXPLORE.EXE 896 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exeiexplore.exedescription pid process target process PID 1952 wrote to memory of 824 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 824 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 824 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 824 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 824 wrote to memory of 1688 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1688 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1688 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1688 824 iexplore.exe IEXPLORE.EXE PID 1952 wrote to memory of 1628 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1628 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1628 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1628 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 824 wrote to memory of 1624 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1624 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1624 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1624 824 iexplore.exe IEXPLORE.EXE PID 1952 wrote to memory of 1852 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1852 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1852 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1852 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1124 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1124 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1124 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 1952 wrote to memory of 1124 1952 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 824 wrote to memory of 896 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 896 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 896 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 896 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1500 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1500 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1500 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1500 824 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe"C:\Users\Admin\AppData\Local\Temp\a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275468 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:406550 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275479 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BX7VLWSF.txtFilesize
605B
MD5e76be252f6eaa589b9c6aebc34a03058
SHA18ff6c1bcc0d71a9336cf352cc320ea5defe886d2
SHA256dca447e99de75667462f00e313b058fe03322f584e69fd5a4522bdf0ec736eca
SHA51243b39c91ae7544dc51e38eb19da584de887a7094043eee9fbb922fc61c3562b26b044764e8d73dff6070e56c0a3c361d4e26ed602aeeddd3f5b4eec384482e8e
-
memory/1952-54-0x00000000750A1000-0x00000000750A3000-memory.dmpFilesize
8KB
-
memory/1952-55-0x00000000021B0000-0x00000000022A0000-memory.dmpFilesize
960KB
-
memory/1952-56-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/1952-57-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/1952-59-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB