hxxp://zuzivebi13[.]xyz

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zuzivebi13.xyz

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	api.ipify.org
71	api.ipify.org
72	api.ipify.org

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000985fd0f2ee936d0618a63e08b22e8e4203ae1cd4c9a3000be66e3789947b1b5b000000000e8000000002000020000000b4d132de1e62fe305b18f9187be6de755745ea631949d259e1ca64c7de9e31ca200000002b40919df83ecf4fdb18e2c103c35feaece8539d64319304f9d3d5146790816f400000000637b9dcb43132ed6d835d5f32641d86851f703bccea1374852f7370b9f9385fb554c9dce88a7d06c14ca2ceb5b3f2e689c1f42bb7dee84eb6182dd67210c0fe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50900928a65dd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31022502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "86"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000008eef9c69d178bba6699f6bd66ae0f4ca2fb61f3d7c56fda2349ab0270fe85975000000000e800000000200002000000031f7a59e46a760872f398f3ea2fbd7dc88848e8bc2884be448791b5be6f338a220000000894c22d03833b25415cdd2a54f49121a5d013af9e6589906e7d786a45884c86040000000e5c0f373a7748e1016d0b00db05b4e6968d656bcc7a1753d3c1db51b67481558c02f58fd80ee411aa9fd0589f6a6397fe1c53dd9e0044adabaeb0f3201875f1d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "127"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386354564"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "86"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a970000000002000000000010660000000100002000000018d686db34d308b2e498786d3e6fe75915575e23bd9b7a378cd755f485caf471000000000e80000000020000200000008afeb54734b6cf393f3d40b04801e99cf85f052228cef64c134fd1cfd27ecbc7200000005ef83428884ea5ed2795470bb8ceed9e87cbb85dee8c5aa7a49e2900234b7c1b400000008570dc5f2585205a826ebca87a51222acff8f3e046e1ec7a0b73f4ae435bc39098ad17eec493fdbc07b09658e24ccfc4e486a6fc911817d0d3d8a3c2c69105e5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302c7824a65dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06e741ba65dd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "674065966"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "674065966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "127"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000648427212f17c46d34bb0edc89eb58acbf14ba081d6c08d486260a8841d76199000000000e80000000020000200000002f241f8d9d5729280481c28fad2ff39ee3e7c517b6dca3d78992a1e5eda9fae6200000007545c831d120b4f1343efbaef2755b82b2a9e64ad4dd28e15d762bcececbb044400000000b043ce5af50bb84d283eb7ffc2391bffec2107193cf7246828b93cec8b72b27e8589d9e8f560a72459189c30d7e3ed16cb936bb025b56217c77819f90b80fda	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "684013747"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000b00351b4e1d367117d611a2f7aa728262aa6410bb214c24b3dd16153aa2d2daa000000000e800000000200002000000015c86fbedf337411725de99f3d029d6b95087dc84155df38e602327f7068a30b20000000fb8fe01f010c6bdae274a41538c3c75c21b8d271d83f772d9f1b9faa39d6603e40000000b9c39fd95351b277da6c2d5b83b31167f13e8e3012f4852b50e332ebcac3e8960ca1a1c21183d7f44c56285571562f660b22d6825f153fe8fdd9b548310412bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "13"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000faf2f44cda89cd0831d926189d3f9d2d21847f1cc188aee4da643181b3b3c53a000000000e80000000020000200000006b6caedbca189f86035e371aba9920419a7945f5f3bcbf6136ab816f377d3e9a20000000bdda001a893a1c8cebcbfb56f4184eaadcabc8cb89d9a5e773f7d7f31d7cbe1240000000efb2343edfbe5ad556044824bcb263fcc3ea1aeae29386998945ac64e268bab0e95fd880c9a0a3d8952c3cdf12b709208919d48f84f2a68ec1566eb477f0e519	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31022502"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31022502"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "185"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5351D157-C999-11ED-ABF7-5A0CB913B9C1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "185"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5055401da65dd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d045702ca65dd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\Total = "13"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\Total = "116"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\ = "13"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000001058ac276c81bcb4f87310fdc1b54e9648a993e770253a0a8f633a3b257fd925000000000e80000000020000200000007b80c78c8bb4418ca2f660c9b00f14dee8a65523bddb526e482709b27abcfbb720000000eed34d47da5827b05fad38a76205517e0087dc0f6bfefee05e6fb1fd6a37e944400000001e3f3c321d4e9d9777d704dc70f819a3c9bde5bed598d16afe1ae7c42cc4eb4ed8df3886ec4741573cf8b3aee782c8cf5b25294e0bacd1f4f69636ca4d816be7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300a6621a65dd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\Total = "86"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws.com\Total = "185"	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{1AEA9089-97FF-4191-9047-1C491559C559}	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: 33	3824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3824	AUDIODG.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: 33	4644	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE
Token: SeShutdownPrivilege	4644	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4644	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1192	iexplore.exe
1192	iexplore.exe
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE
4644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4644	1192	iexplore.exe	86
PID 1192 wrote to memory of 4644	1192	iexplore.exe	86
PID 1192 wrote to memory of 4644	1192	iexplore.exe	86

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://zuzivebi13.xyz
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c0 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
259B

MD5
ec681cf34f8addf844c95a37ff290a75

SHA1
2920c961567de4096083489d8519c801738f4b36

SHA256
cc57c29602b702f33a8d5288ac05813662761781ac14154bb05523c0104422e9

SHA512
1fc4b6607d1099d4cfe0ceb741c6c994775e8b47c7217cd14ce729e85a627a71dfcabbf5d36d46c5adde9ba38e9a577364c5346b58b4706667f7d163ca82c165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
322B

MD5
fa4d3dab3e1f583aafed219673906fad

SHA1
aeaf30a7885d74bebf88c7c2718afae1e3fe4b25

SHA256
da5cee93c4a9f2d19f97777c42af64b39788ffbd17209968aaab1c42b4628ee8

SHA512
08011ce0ca43d972ad1dd09a0ea6ad5092980da40a0a4f3ac7f7038e4e29f1e5448a1a1982db529b8530132ada36d2a470fcaa0f2640c385172182330081f469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
322B

MD5
3cdf36524c3f5db4650d4795dc464f8c

SHA1
ab421321db535fff042c6928dad386d7923c8565

SHA256
264774575d11069bc48863e8ab00bf2079caa72833803e76fa82efed552c3a9b

SHA512
661d193fe0b12b08553023a9cc03f7518d4e32b5b5f32518ed915c4bedde0cbe9db00d52a1d82e7fd8ec5864402cebc4e43d10d329919028fe6098aa48f2c8b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
322B

MD5
106bf6c9e7b1a60ed2269cf9e03f2c8b

SHA1
506f050fa0cbd838d4f2c158f7b15f992efe8227

SHA256
9fcdd42c48aadc76e44980ff56c6c50c3692e97de39ed657d1cae91e6a7eacaa

SHA512
5f03c4e5190361c30311a3d8a9033f39f9c8f6933df8559890796c58b5f982d1ac1794094b577197bc1fba275fb014e13c216724c9bacdfe9cd4d2ba13b6b6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DVG6DU85\0071a8ef-8b7f-4cef-a2b1-9b06156ec810.s3.ap-northeast-2.amazonaws[1].xml

Filesize
322B

MD5
1182dad43154e2d347afa71c5756f31d

SHA1
3158048838f95c5cf1b7833699611117a4be151e

SHA256
e71a91740e309587c536a61f7cbb49b89f070726fb439164f0cb4c6efd2dfecf

SHA512
e17b67af3a1f351132e8d7356f1c4861d0a4e6cd8c3b806bd144c15e76af5ee7aa9bb1d1dcf4f801f8253e15d8ed5ffaf253d99608fd8b6dd2f5a574ec7d76ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit