Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2023 19:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1eHyPquDkIMRTiNVtWq_aCISgSkV0zj2b/view?usp=drive_web__;!!BeImMA!-8OKRyXGFX55C8IR4DTkepaRdNXJL63URxhd5dRe-DQ18OUSelOCpJ2IqN7aP6V-X0JXW6rHhw53gHne5DaeXEWK2A$
Resource
win10v2004-20230220-en
General
-
Target
https://drive.google.com/file/d/1eHyPquDkIMRTiNVtWq_aCISgSkV0zj2b/view?usp=drive_web__;!!BeImMA!-8OKRyXGFX55C8IR4DTkepaRdNXJL63URxhd5dRe-DQ18OUSelOCpJ2IqN7aP6V-X0JXW6rHhw53gHne5DaeXEWK2A$
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 861a78379e45d901 iexplore.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035215" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1157346800" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7036D628-FB42-11ED-9156-62EB0CDC8974} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DOMStorage\drive.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067e7c5b330bbd74eae3b1bf5f9aa6ef400000000020000000000106600000001000020000000e0926dc3da1e73b84657f8c087e6253dd2b6479613a8dd4069a72d5db6cf28b6000000000e8000000002000020000000d5a79abfa4164db1065e1bdd70381e9be9d97b4445cd0e314b1e16f8a31dbf0f20000000df91b667c460471f6df0b813a580a94fe7c726aaffee05c82536b6f4ea892c68400000008c49397f6709dd17de9f8c96395d4bf1b717b5cf2613b2a20391cefd527fefaf8b04d279dcf6cba84537baa99f5a86c74296f68943b731508ed348c179365801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\drive.google.com\ = "6" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067e7c5b330bbd74eae3b1bf5f9aa6ef40000000002000000000010660000000100002000000070e1ef370f3ab811658349bc906bc203297efb57f5e2280572a34bd0d75b2740000000000e80000000020000200000002fabd69430ea97c6cf86e205fc5082b8a489fe0f9891571b652b032a0f8675e1200000007770ce95046fa7ceee1c64cb6208d7c0a747fe30ea551b9066e30073e8eb74c9400000001361b0e48e7cbf09163e17caeadc3eda1c3af5f19ecb3547b9591d355c3a6a9ee47215811a4a57574db7fb4511d2ced9304030eaf8a9c2e2ddb719bdc6ad8d62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407b0f494f8fd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c7154a4f8fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1157346800" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391814805" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\drive.google.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1179689780" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06edd484f8fd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31035215" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035215" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067e7c5b330bbd74eae3b1bf5f9aa6ef4000000000200000000001066000000010000200000005edd7ac8df718e92520c3d5519f8b0d2074bb38c26de5e80b031eece1107091d000000000e80000000020000200000002e3573b3d26c4be9ea57ee199f6419fcd1b1f6de3ffd0e6350bfcd402501b079200000006ae3375c64f0bf0561a464abd39120bbf6e278c6d5624c1a219036c8faa3cd5e4000000087cf336604a36c1ba3bc8803c97c349d44e0c9ac1b4a633135178966f4209fa710f92e69140658c673e712ea91478c5801a5cccd751f48db87baf4311a128e06 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 5088 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 5088 iexplore.exe 5088 iexplore.exe 5064 IEXPLORE.EXE 5064 IEXPLORE.EXE 5064 IEXPLORE.EXE 5064 IEXPLORE.EXE 5064 IEXPLORE.EXE 5064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 5088 wrote to memory of 5064 5088 iexplore.exe IEXPLORE.EXE PID 5088 wrote to memory of 5064 5088 iexplore.exe IEXPLORE.EXE PID 5088 wrote to memory of 5064 5088 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/file/d/1eHyPquDkIMRTiNVtWq_aCISgSkV0zj2b/view?usp=drive_web__;!!BeImMA!-8OKRyXGFX55C8IR4DTkepaRdNXJL63URxhd5dRe-DQ18OUSelOCpJ2IqN7aP6V-X0JXW6rHhw53gHne5DaeXEWK2A$1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5088 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5856c42fcc41e6055fec4c82eb761c89f
SHA1a13ad86fd12b9f11cca79f825b0be57f44c8fc22
SHA256cb07236840471054f94b674a01baeb951ee2c6f3d41fc8ece6ff095cc7f4a4e8
SHA512f0b518d3722d59cac9f8bcd2b4a06834debbba94a42145177aa50f4bb8579b3e730155f27fcb58636a7f8d4e74cdebf9a47f8c8cfcf167acafeb1ed976ddb1d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5f84a535d20b640da40b9ccc19b23b039
SHA17da168661823a7380ea673b3288606563c0c3f48
SHA2563609a196e814bf9ff1a492836af3af1761634d2eb4bab4cddd3a94b20658f13f
SHA5128ee5864bb5c3a89de339c2c7a203239273a862ec21e1cc58c2c5ec6b641604e7802e3afe6d1d33e22f5b7fc5e5e9d3fee08c91e541b964d7eabdc3f09e8316d5
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\S24MVYDC\drive.google[1].xmlFilesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\95fmw5u\imagestore.datFilesize
1021B
MD56f4571c4f084c4de700447dbc5436f52
SHA1ee47d4e71598ddc3e6122acf9188656561f8133b
SHA256b2e9e59e8d79912a2d20b5e0922f4fb9ba7f0eb48ff90a3bcba8c59421013cae
SHA512905a69c0e816201b82cf958af6230c163ccb58e8df2581e03abab5b8f0472e7f19d2961c8e613e14e606a5fffb0e837c1142d16bf15285f3111516e5c17f0d18
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\95fmw5u\imagestore.datFilesize
2KB
MD525da924d91a9876904bf752538f09e29
SHA102c3a700e416880905878e1742c929332ee37a6f
SHA256b2695e418b46c70a2f3feda1b52b73db06d49fff44c3c3c3b850f709385ec498
SHA5126e998d57205903f024b76fbc0d2ea1fba7250dd3bf65ad85f162e9f141b73e80a1828008fe7636275b2337781ec2e263a8e1d743a65bbef2eba37170b3357468
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\drive_2020q4_32dp[1].pngFilesize
831B
MD5916c9bcccf19525ad9d3cd1514008746
SHA19ccce6978d2417927b5150ffaac22f907ff27b6e
SHA256358e814139d3ed8469b36935a071be6696ccad7dd9bdbfdb80c052b068ae2a50
SHA512b73c1a81997abe12dba4ae1fa38f070079448c3798e7161c9262ccba6ee6a91e8a243f0e4888c8aef33ce1cf83818fc44c85ae454a522a079d08121cd8628d00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JXO1ZP0L\drive_2022q3_32dp[1].pngFilesize
1KB
MD5c66f20f2e39eb2f6a0a4cdbe0d955e5f
SHA1575ef086ce461e0ef83662e3acb3c1a789ebb0a8
SHA2562ab9cd0ffdddf7bf060620ae328fe626bfa2c004739adedb74ec894faf9bee31
SHA512b9c44a2113fb078d83e968dc0af2e78995bb6dd4ca25abff31e9ab180849c5de3036b69931cca295ac64155d5b168b634e35b7699f3fe65d4a30e9058a2639bd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JXO1ZP0L\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P8NMKCW2\cb=gapi[1].jsFilesize
71KB
MD5532655ad32d7392fbd756a13971eaca5
SHA13762be5ac389483aa259560db54064a0e65b6dbd
SHA256211e59d3d3dd0a6e43a866197a6214e70da275b60eecc85cd5a8b6a7e9b46d9e
SHA51230153f19ccede229a0a682b35c45eaa762457dc3b862ffde85a84128bc3b849c3bf3f4d41b0ff78b6dc24490d387051f8029e2a34fe0cff55d45370c71b5807e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P8NMKCW2\cleardot[1].gifFilesize
43B
MD5fc94fb0c3ed8a8f909dbc7630a0987ff
SHA156d45f8a17f5078a20af9962c992ca4678450765
SHA2562dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
SHA512c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e