Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2023, 14:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wonders.fun/xmTt1tryZ?i=yX6WlNYVgT
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://wonders.fun/xmTt1tryZ?i=yX6WlNYVgT
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31032562" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{08B7C2AC-F0E6-11ED-B7D7-DAE3AE61CC88} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e061c7d0f284d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31032562" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3718264103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390675605" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000894536f83f65e65905942f223e0e0bc040b9951eb7321643682f6fdd98b16bbe000000000e8000000002000020000000ef287c3a2f32e665b7dd8905333697e11e0c184aa536e722cbe1799af9583de42000000038c8845d46cb1bc5da430f95d0acd03bbbfc19549a2c382d30c6bead6b09dfcf40000000463c09f5c98155b214568182d7b346b4679b71d0db6babbf343d5eb7aa6787d09ec7380260a03debaed3e52648469dc36647616e06dca25dd4bb81ccca1e3958 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3718264103" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31032562" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3727571769" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1013461898-3711306144-4198452673-1000\{BD4DBCC2-C30F-4DCB-BFCA-737E45EE9B5D} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: 33 1412 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1412 AUDIODG.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE Token: SeShutdownPrivilege 2528 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2528 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2692 iexplore.exe 2692 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2528 2692 iexplore.exe 77 PID 2692 wrote to memory of 2528 2692 iexplore.exe 77 PID 2692 wrote to memory of 2528 2692 iexplore.exe 77
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://wonders.fun/xmTt1tryZ?i=yX6WlNYVgT1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2528
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5101⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD50458359bb800b25cf96b67fa93a6d3db
SHA140c02db12aca622ec25c9353528d926e80639172
SHA25627086dab961b5522e09a12bbe09bdd89a6d851bbce84b734326fe866565fef84
SHA5129e669c30355652c39686161870ddf3d7837088594acd34dd283d004cef3b3ab245699d0920ee08618095e2d31017323e7144f518ed90b66e2eeb38dd375443a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5c904e163d2ad168bcaf1ce22dc917bf7
SHA1e669d1975fb8f61c134e6244d7739f7763ae7772
SHA256945eb6b28467c525f04f71804fb2de42c14de07ee9ec6bde48933a3f6005836f
SHA512b36020c54d173dd0836e742d1f954f7358d68b1079b08969a8e5e61d2c5db74d430fbcf7781dba2b8fdff70c58d133bf4a49cf5b1c0e997bd4bd9a6fd5fef49d
-
Filesize
11KB
MD562b03868f5bfe214bbb419bd816d0f96
SHA10d921cde526d29672225276f782453f96824ca4c
SHA2562f62720eba2d566747aedd8746dc254e9e9f58ca72c688ffbf7255df6959c3b2
SHA5121902e0189a62f439a07f690752221871ad034d9ea60d26c88a9af0e6cce6f4bf62921c50e0270edbfb682d3da540ec5d742e3c4640c133f36846f190ee44507a
-
Filesize
12KB
MD5e54febfa512d95d231542738ecf797b1
SHA1cf07d58812e4b7ddb75b380bfb1d9349cc7bc4dc
SHA256b9de23daa804916371c229cb41be227673d5f10ce027ba203d9767fd5ca21981
SHA512ed2e2190f9fbf2ef590a3fdf193eac01d8b108d212e7dfbaa7a3db80c2147990bca08e0cbd048e2d84a5738ab07acdd01c10c65eea8b409b2457af4d812c5dfa
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
11KB
MD5570b900c2ccd51d6a93d6202e21808df
SHA1a532b7b98ecda35dc60115a82cb46eb24e552a99
SHA2566c7ea129fd71eb770c8771a4b268358bb309697a97d0518bd59f5ff418f76452
SHA51248092d18aeb7ecbb09d23fc8ea1eae1ac8623860a98c06aa6ffedd01390eae57a1f589d3efedcc4ad1a89761b96a6ecbcd952b9386f9f0cc0cad7e55eeb1eeb0
-
Filesize
1KB
MD52523596efbc9327788c39061df882de9
SHA19324fbd0d22851608b96d6de8612f063739f2117
SHA25658c045dabfdfb741369b7a46515a9374c92493b73c3ca1724b019957720a76e3
SHA51270e1e480a3da9f189746763afc6dc7982b79dc602b428dd5f74c4d90c6318621b96c9e816b62a78d69d5610d6d5651ecb4339d909f84f48a86cb6f4cd3169995