Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2023, 10:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://neros.rs/WW/mail2000/
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://neros.rs/WW/mail2000/
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://neros.rs/WW/mail2000/
Score
10/10
Malware Config
Signatures
-
Detected wetransfer phishing page
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31012404" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2674709329" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bba490b2619dbc43a0228a653f9d3390000000000200000000001066000000010000200000001b84c19d08d00d26f7054b74161d26d9d4c70d47cc7a8cdac16d355034d37f64000000000e8000000002000020000000872d43b1d1fc522cbc1b5c8e444e7b4806dedea4bf5a747fd6dc154623d097e120000000dff2ab85550389692beda866c58943c69439171719be77deb8e737bcd7ceb51f4000000019518a62c937f7cb0d929dbd0458d8ab502baf01000c7fc2b865d938a30dc0e824db703e124ecab77b341a3030b31333eb3331f97e467ce61005c72b57240a6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C9324198-A227-11ED-B696-DA88DC7FA106} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904d77a13436d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2655410353" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2655410353" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31012404" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31012404" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bba490b2619dbc43a0228a653f9d339000000000020000000000106600000001000020000000e5e2b74c46200ca63faedf2a011173ff4ea7020bdc23a12b1c0cead83381c27f000000000e8000000002000020000000be7f938fa6cec13f4cafb87e1a0627d58addbec7d4680861372ddc4600b2ec6f200000007f2adf1be9074f790cdeedbc4c2fe017b16517d3cd338edc87b2e1372b88f07a400000003a1f1c98587e31123691a69b4d4b88ae7482060dce53af6ea9a816d6326aebea02515e1b02df440b09e57684b255faf47386448a4bbb9fe7d3a3e4e0771e89ee iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e49fa13436d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382017704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{E711F5F2-CA4F-472F-9613-DD11B552BB41} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4860 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: 33 1764 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1764 AUDIODG.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE Token: SeShutdownPrivilege 3904 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3904 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4860 iexplore.exe 4860 iexplore.exe 3904 IEXPLORE.EXE 3904 IEXPLORE.EXE 3904 IEXPLORE.EXE 3904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3904 4860 iexplore.exe 80 PID 4860 wrote to memory of 3904 4860 iexplore.exe 80 PID 4860 wrote to memory of 3904 4860 iexplore.exe 80
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://neros.rs/WW/mail2000/1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4860 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x2fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5627082c64c12e33958757c71e493e289
SHA176523ca1f952da5ca306f72c6efd497fe90085cf
SHA2564939d97986cdabd824b38fc8ce3d4b8b6ebeafb7a113d2af94944b09e33454c8
SHA5122cb4f47a38d99edfc1c25e520970fb057acdf589da1d097d0a621f020cdb843e8c3fe559d1098b04161f22d0596ccaf34d526b4ead38e5bb94421a5b209daeb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5315b35b4cf364fe535ec2ec9a0299459
SHA1e868755ee1bdecfa394fd6e44a9121bbb9ac1cf7
SHA2563d6287295f41cc05a7b4b74c294d4a2b0cff3c3367fb7385ceffe35deffbfc36
SHA5124020c523e8d4014e5bbb646cd64e90fba7486068320b43d47b4cfc8ce7f315936eb05b02a47dd66a994645e1d404c5e6acad45c938fd73ca93a459364e2a0760
-
Filesize
41KB
MD5799e99274de9fff6936d019d443de966
SHA17ed446a8c74e5f97e433e0797c13350624fbb233
SHA2569c931505e37c6c3e59081e390a49ee9a86ceb8f0fe13ec277df5ff60b8f851c5
SHA5129d67f1a085ec18b650c11c2e1b03455d1bec59ae53a5478602551c3e504ae025c66ecc89fe186bdcae264f538706da180cdd78d1dc80551cee6cbc55758a572c