Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 12:28
Static task
static1
Behavioral task
behavioral1
Sample
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe
-
Size
196KB
-
MD5
8638468be18f63e7190d6855c51e9e50
-
SHA1
508ae3e49b8c8f3d82df2a6f132863a3d995a274
-
SHA256
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c
-
SHA512
5f8017f6a188ce898316741e700f77d4a76b0895fe556862d29837c29ae83ff50ec22ce19f23305854e77796400fdca3a76d81e01ee06ee03b05c515dca21134
-
SSDEEP
6144:mY3UEJ5yEMbOR/BV7mNwrTrP9TE4qyEyIQ568:3FtR7AwrTrhZEyR7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3464-133-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral2/memory/3464-134-0x0000000000400000-0x0000000000496000-memory.dmp upx -
Processes:
IEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3480226397" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381160813" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011813" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011813" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3480226397" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DEB69168-9FD8-11ED-B696-CA2A13AD51D0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4736 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exedescription pid process Token: SeDebugPrivilege 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exepid process 4736 iexplore.exe 4736 iexplore.exe 4736 iexplore.exe 4736 iexplore.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 4736 iexplore.exe 4736 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 4736 iexplore.exe 4736 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 4736 iexplore.exe 4736 iexplore.exe 4736 iexplore.exe 4736 iexplore.exe 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exeiexplore.exedescription pid process target process PID 3464 wrote to memory of 4736 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 3464 wrote to memory of 4736 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 4736 wrote to memory of 1688 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1688 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1688 4736 iexplore.exe IEXPLORE.EXE PID 3464 wrote to memory of 4188 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 3464 wrote to memory of 4188 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 4736 wrote to memory of 1072 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1072 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1072 4736 iexplore.exe IEXPLORE.EXE PID 3464 wrote to memory of 100 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 3464 wrote to memory of 100 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 3464 wrote to memory of 320 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 3464 wrote to memory of 320 3464 a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe iexplore.exe PID 4736 wrote to memory of 3184 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 3184 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 3184 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1512 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1512 4736 iexplore.exe IEXPLORE.EXE PID 4736 wrote to memory of 1512 4736 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe"C:\Users\Admin\AppData\Local\Temp\a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:82950 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:82954 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17418 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings