Analysis
-
max time kernel
55s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2023, 06:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://zhjdfzhgtfdthafda.s3.amazonaws.com/zhjdfzhgtfdthafda.html#rd/c1919JTrpi460677HsZs540033AsJ14683HemH461
Resource
win10v2004-20230221-en
General
-
Target
https://zhjdfzhgtfdthafda.s3.amazonaws.com/zhjdfzhgtfdthafda.html#rd/c1919JTrpi460677HsZs540033AsJ14683HemH461
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7B3517C0-FA0F-11ED-8227-CA88EA23B6D1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1336483735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006cbbeefd734e264ea99e9978e4f4ca4800000000020000000000106600000001000020000000b1606427e5c85493a7ac2fa6ff50467d0d2c6c157dcd919e5b7f71032bf4b2b2000000000e80000000020000200000008fdfabf79c2154ce6141bdd82eea6865f763b287348a5695fd7c2eb7d831cdda2000000097a4634ba1ee02fece9fa49d0979b4bb24ccaba8fcdd7d1812e3b8552ad3e639400000001ca1541d894f4c48fa4a750211f8fcee57a728c94dde8150aef31cd0f9139af786ee6931bc295bc76e0039c8b419cedc2f76c85934ee30f3b7db12c304429faf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1336483735" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034908" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034908" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006cbbeefd734e264ea99e9978e4f4ca480000000002000000000010660000000100002000000060af7756368d3e939507df88a7f9e07853bee5813fefcc5164f03e17c1c788d8000000000e80000000020000200000005b8f694c752080a700112a74446563ce3ff06ac943f3fdbceb89e72f2059c304200000000bf3c8e5192442f4a8f02bda67f952f370f8543b1db46a08dbb7164578ac6e59400000008b9c5c6b5d4ef3f8cbe3575941968c7ff19441d294a141f455e2bf0ab91df2a0adc5a5e211cc6b9aed76eaacc548e30006734f3acb90efd9b5f71ea8d20bf232 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1346482846" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31034908" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08999531c8ed901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c8b3531c8ed901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1996 2116 iexplore.exe 83 PID 2116 wrote to memory of 1996 2116 iexplore.exe 83 PID 2116 wrote to memory of 1996 2116 iexplore.exe 83
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://zhjdfzhgtfdthafda.s3.amazonaws.com/zhjdfzhgtfdthafda.html#rd/c1919JTrpi460677HsZs540033AsJ14683HemH4611⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD594efe971fd70d9d426978045456a879d
SHA197f170ffda6afd79be0795ffcc37c7efd82ee801
SHA256fcfaf64c502c0feb0175aa72247927eeecd556004302a20e09f6fdaa644504e6
SHA512baf5e9e1e9bbbaef3cd6365ec2b1c71314c14d0acd5837c1975e71a374b9fe724035929b47fe5bf5aef5845ef6eb17b178f20460b115419094733dfc8a27799c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5c97785d89884ee4d4ae774d28ccc7e14
SHA1476ab7a032022016a5630345b2769f3c50f377ac
SHA256aefcf3561d8e8f0822bb85f689aa55e84aa0bb406b14ec728428ab606cc12bbb
SHA5124ed79e4dc27c1943c73482f7788a0e23017a53c7f7bafe437dd443c143156c4bfde72da984500b115dbd37e41004f8bd744c3b0d24987045232f2e274d4fa27c
-
Filesize
15KB
MD50c538b54b927580ad27085f2ef1c3a3f
SHA1f14cb8564d31b8d6780b01995331be6c7ef940b3
SHA256eb5d5cd34791b2ce1a5269c7a543a7f06ea480162dfb6865971b6d92a45f4951
SHA512050c46c5d2f53191e15e5584be735561108ac340178d2d5760682396cfe5dfa0aaa0634f9ee69cb39667e0c32baffe23fabfa7f90dc032af673c1d0c11f40f67
-
Filesize
15KB
MD59e3e8b6d89d426ad950f5144d15921e6
SHA16cefe5c7ca4a97d2118fb849f37f4ffa4f9f0ee0
SHA256703063f5cfebf76bd6190dd87052d6664d3a0fcf474d837d89f6b7fae7a8f3b5
SHA512a063be8a7879b431338506aea3975376f7addf2b9c01563f4aaefdaa827c2568f76da0b32bae9665e09507c9cebb44fabe6d194e5944e000fc299fa0a41f1c44
-
Filesize
15KB
MD59e3e8b6d89d426ad950f5144d15921e6
SHA16cefe5c7ca4a97d2118fb849f37f4ffa4f9f0ee0
SHA256703063f5cfebf76bd6190dd87052d6664d3a0fcf474d837d89f6b7fae7a8f3b5
SHA512a063be8a7879b431338506aea3975376f7addf2b9c01563f4aaefdaa827c2568f76da0b32bae9665e09507c9cebb44fabe6d194e5944e000fc299fa0a41f1c44