Analysis
- max time kernel
69s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
24/04/2023, 16:52
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://192.81.212.186/#bWVsaXNzYS5zeWx2ZXN0ZXJAZG91YmxlZmlyc3RtZWRpY2FsLmNvbQ==
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target http://192.81.212.186/#bWVsaXNzYS5zeWx2ZXN0ZXJAZG91YmxlZmlyc3RtZWRpY2FsLmNvbQ==
- Sample230424-vdlspsfa2x
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389127328" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e25003de76d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2B2B858B-E2D1-11ED-9F77-DA4DA442263B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028958" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000b69b00b269ee346fdda55ef40943ddbe0d115be36a1887e0aaef57ee543eb692000000000e80000000020000200000008c943a009e0120e1d83836fc9b379343a6d16529b59d384ee9545269b657690e2000000096f56f1fc0aedd21234c71dca9c7b022fe9d272dfb8daa94fa37dc02f0142bc440000000369b1c9d259003e8f1ff0c134b3cb327bd039e9a248c4eadf5f4c7360f3a01dc75f0398bc30ef4bd2aa16fc47becb5d91ca10c09bc11c81f3ac99bfdc95c8e1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31028958" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028958" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "22668770" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1105326" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fb4403de76d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c000000000200000000001066000000010000200000001cf6589e2e635424124ae536c29fe63778b4d6638dedcf306c4cab1e5e54adca000000000e800000000200002000000036169af2065b65cb7d043494182a2a57b5c807434db42c89cccdc7535e7a924f2000000011b62b28a52d53746c268fd75bd851ec82f56d0810df572822db81dc38335cb7400000003d4afc5f5f43120cc8c3ab03aedda9c325e36c8d115093568460e703f99692340790596d93a9785b7887751649a941cd0585217de4944e7ce72ae177b4790b51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1105326" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 444 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 444 iexplore.exe 444 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 444 wrote to memory of 2884 444 iexplore.exe 84 PID 444 wrote to memory of 2884 444 iexplore.exe 84 PID 444 wrote to memory of 2884 444 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://192.81.212.186/#bWVsaXNzYS5zeWx2ZXN0ZXJAZG91YmxlZmlyc3RtZWRpY2FsLmNvbQ==1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:444 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 ab4f8d3ad2a02ad67059703fcb9c7ecd397d9abfce4b4cacdf7ecc11b4e37520
- MD5 d6b67afeb31f0d9bfe232166e8b300c5
- SHA1 6ba1a534d40fea9302591aaee8fb6969bfa28e4b
- SHA512 62c9fc6797c263bf33c8f52d5d41ce276b3df2aaed6433d582987a607ae508f5389f86d5d8a63cc5715964623f5be08d5741ddd70a0fe18f0140eb314815c272
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 a68e493d5b5665691bfabb20c484af97c0e601b4483844fa4368be94735b8102
- MD5 bc1ef694126b1db30f00d64fe95021c7
- SHA1 3820b6915e6630e5dc527cab980815aa7f856062
- SHA512 ce0cf61c216f9be74f21a6a53ec5570512839482c4322cad379ab4c3e9606f43e92161380965958b0fad3e07955c02bf7fddf07ee63fe242dd68af111544dce8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat
- Size 18KB
- SHA256 7ddfc973cc8ef430bf12f3420454b8ef180bdf698a31199c8404deaf61171a42
- MD5 6d7208b08ca0604d84bafa94fb0b892d
- SHA1 5a947fb0b7e76f53a07a0e5a8bf058fca7b0afeb
- SHA512 85a00610062f4588cdecdecf4bd107d71e0f8485853085491ccfb75f25d2acd07c9f3beeb4a784727acf7ccee899c80a98e6e736c9447d107e28dbd7e19f8002
- SSDEEP 48:yIM52IM5TIM5bIM5YgyyyyyyyyyyyyybIM5KeIM5/QQQQQZ:dMXM2M2MPMOM9QQQQQZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat
- Size 18KB
- SHA256 7ddfc973cc8ef430bf12f3420454b8ef180bdf698a31199c8404deaf61171a42
- MD5 6d7208b08ca0604d84bafa94fb0b892d
- SHA1 5a947fb0b7e76f53a07a0e5a8bf058fca7b0afeb
- SHA512 85a00610062f4588cdecdecf4bd107d71e0f8485853085491ccfb75f25d2acd07c9f3beeb4a784727acf7ccee899c80a98e6e736c9447d107e28dbd7e19f8002
- SSDEEP 48:yIM52IM5TIM5bIM5YgyyyyyyyyyyyyybIM5KeIM5/QQQQQZ:dMXM2M2MPMOM9QQQQQZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico
- Size 16KB
- SHA256 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
- MD5 12e3dac858061d088023b2bd48e2fa96
- SHA1 e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
- SHA512 c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
- SSDEEP 24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\jquery.min[1].js
- Size 83KB
- SHA256 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
- MD5 2f6b11a7e914718e0290410e85366fe9
- SHA1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c
- SHA512 0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
- SSDEEP 1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP