Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2023, 21:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://app.slack.com
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
http://app.slack.com
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3842787971" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3842787971" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31024763" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b00000000020000000000106600000001000020000000a0a7c8ce8984ec6e1c964ebc78c21ef942269fe577238ed3588b5fcc75460c0c000000000e8000000002000020000000b21b311fc3ac79f19cc07d9e1422eebf1b2e31589ae7cd7d928db55c36ad00842000000033062903c2609dd9cb14df19dd9ab00930c6156b0a4fb563f061b99ff5fc4479400000006bfd34fb6eb2d77958ebad49a6a537385b82f78396b4e49e6dbf18bec6b7f3f2820c6e6dc6936f2a44fe44603ba97c7be0b240263f821a509df30441eb0c0fea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0D7415A3-D26F-11ED-8FFF-C2E0088FA829} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31024763" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8039d1ee7b66d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00fadee7b66d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387325973" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b000000000200000000001066000000010000200000004e7be6280b2de27af603c6e012a68b586664869f7d77b7cb7cc987015ab425d2000000000e8000000002000020000000eb3acc02c3450e34f5d0b26e9216ca8d658bf9b6bbdcd1c0a3bdec50db326716200000004c3b20c8e7d2a42220875e9664b391f8ed6c4b5223b34c93d4d1fd541dc15c924000000002c40a4d8fe7a7028f6a1598347275a00a9187c8b6ed2f37b3d18a5955b7e87f70cd3dc5b32e3ea5be7d94c40ed5ed93b0f830334d1fa9cf342224f50831e3c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31024763" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3855171108" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{FCA13B1C-5403-43AC-BE9F-B75A82AEF639} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3524 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: 33 1408 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1408 AUDIODG.EXE Token: 33 636 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE Token: SeShutdownPrivilege 636 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 636 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3524 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3524 iexplore.exe 3524 iexplore.exe 636 IEXPLORE.EXE 636 IEXPLORE.EXE 636 IEXPLORE.EXE 636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3524 wrote to memory of 636 3524 iexplore.exe 84 PID 3524 wrote to memory of 636 3524 iexplore.exe 84 PID 3524 wrote to memory of 636 3524 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://app.slack.com1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3524 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:636
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x344 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD58b82e64a7691fb70aec48c12c37eb312
SHA196084b73e24ced2adea93695f71a62092771ce79
SHA2565e1b36f0cccb94221d862d2fe35c892d699d397a87f74f18a668a57ba7ef8d5e
SHA51236802e6043f76d717a376d762f84e89be4bf5b6675bcc662f9f768dfe6487582654333ede1f871cadaa5b5120ad5147ca81bd79b5092623d38f1fbf4037237f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5d3e44299c13e5598c8f49cdae214416a
SHA1ba495dadb1fa9aadd3d1b4087bb865f0cd20e433
SHA25676d223f50b66f89b5f56307a4da2c65bc63854206a71b172f30ab5d7e3283db1
SHA5129eb74bd67de9c31a9889eb7357438495f58da6b3d6b6b5b8cf3f5de20447dc6770974d8f16a5200469b767927159cb0cd110b30aaabfaab50f5be7bc9cd463f8
-
Filesize
1KB
MD5489f20f84cc21f1f3277a0e238d59467
SHA1be1b571f0ceef311aa8063781c6523b248f11b61
SHA2569430134e28d0fbc118db4084b821e469a7f4d35f08c2ec79e5b60f4998bf2daf
SHA512f2e8820d3d92290c733c0bd174a2272a1c88aeb6390522e5a52ee17850300003ba2a8ffa5f3beedfc713518a27f03ca7c5573524f8ff9c5a0bdf898051530caa
-
Filesize
1KB
MD54d93fee05ad86462c5af801dae6b8d7f
SHA10d1a4ad2274e00123f146e04e25d300cde546a4b
SHA256b064e0d943b3ebf1b2106fc898ef98168bc4ac3787e296822796863c8e907082
SHA51220c61ccb2a7b8201214ba35c09329472a13ffb29b4eb37df63a01e2027488e1ff59098e60cd01133887658b91071a71636f1c368907dfde8055347c87ebb4343
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
