Analysis
-
max time kernel
35s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2023 15:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://goo.su/TfyXjk
Resource
win10v2004-20230621-en
General
-
Target
https://goo.su/TfyXjk
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\ = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "51" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\ = "74" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "38" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\Total = "38" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041203" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E801A4B6-12A6-11EE-8DA0-D2427B744E66} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d53c3f41f06a2044adba6d75851c4759000000000200000000001066000000010000200000002e065e0c2bc673c60ab5be45c273a0efd0941939c8c3bd62baff53ff128959e5000000000e80000000020000200000000d2695ff40eaa42f081fd8fb7f24326406e7f6aa7e747aaecc43ce69ce02fd982000000024e43090fcc5b10f2eebb0833d10ea6499f37f559e07e0efe4c82b363fe8f98d4000000045d7b91ff5f3daf622cf3a2f466af653320ec3f880784f9dcfcd355ec9bf01a4d6f7184d2557434df0d32b6bf040fee5f943b31bdf9346833a9072109dd93fe2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\ = "51" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3164339873" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3173559770" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703dfebeb3a6d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\ = "38" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31041203" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041203" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d53c3f41f06a2044adba6d75851c4759000000000200000000001066000000010000200000003edaaa5db690abe4a1fef8d7c2556934666934b83b1b8aa46c469b2635495dd8000000000e80000000020000200000005b2e01d1cc159474ecef938662be6ae5311f682dd76709c01de0c1e5716ac4be20000000f144fd9a0f159c3d669052c6b8cac919d294c3172fd21ac0a78ee73b36b0a0d040000000f6a0ae6657275b92863cb033fd8d81a64526879b0a2b18910f241d4f7f99d100e134a13e193c6173898e8c2157a374b1e49cd3f9aedd7475760c6a60ca94cc9a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09bedbeb3a6d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\DOMStorage\goo.su IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\Total = "11" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\Total = "51" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\Total = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "74" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\goo.su\Total = "74" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3164339873" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2224 iexplore.exe 2224 iexplore.exe 828 IEXPLORE.EXE 828 IEXPLORE.EXE 828 IEXPLORE.EXE 828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2224 wrote to memory of 828 2224 iexplore.exe IEXPLORE.EXE PID 2224 wrote to memory of 828 2224 iexplore.exe IEXPLORE.EXE PID 2224 wrote to memory of 828 2224 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://goo.su/TfyXjk1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\M70M7K77\goo[1].xmlFilesize
270B
MD5f247ce99d674238d3488d541de3adc04
SHA1ddf775e6d6d0266fd8c97a9f58348fe1949220e2
SHA256df6c7f90e167f123715b728211d54952b36b223bb8e967abab4487c0170efa91
SHA5122138398ff13b7d02527c46e9d4a1366dd7c5737683c1df3f48d0365e8a30c9bb23d25895ff751c782ed7e492a207f89c8add6c15a96db5403bdda44954a0ba0e
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\boznf1h\imagestore.datFilesize
2KB
MD5772d4f7e860b1a2cd9f72d0741593c9e
SHA13a171bad2fbb7851f4f2f49e443a1bb63e37441c
SHA256ef6787533915c026b03cea14c3f159f96d177a4cd25d439d83bfbc82d7f44ae9
SHA5129218eb220a9c145f9d78f3b0d74d258fb910c19b7da131d9cd8aa4c12a36295e6ea2e31195bfc77527c610d09b06672f3a9e35173b3837688c9e73cfaa66577a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6WT1PKWJ\favicon-32x32[1].pngFilesize
2KB
MD5cf3c040ce98e89e7e8fdd15fa990265a
SHA164792dfe9b4d64981ac299573c5966f9ab42dc07
SHA256d6534b8e4fd6c8408559b3fcac1ce461c2edbbe9f3b81b72fd00acf00e025ef6
SHA5123642b679695c0572f10f7637721b60303249b0dbccda9b21d592631dc6f58082eb33422dce770697c3aaf0c4066af860ec2b9272d146e6613465f8b44b247448
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\97XIF11T\context[1].jsFilesize
308KB
MD59d27091963e7056256d9dce8ad68fc96
SHA1e72c8e93bf4633e5377c282d38a9731aa47f946c
SHA25628ec3b82087c4d9561935e38c48c59686012fd1a5ea32abc95af11a424640025
SHA512c50642f1f165bfd430fa175b62de4e5b1a71436abed8969e649da6548e5bfea4e65b153ce340ba82ee919c46792e17847d7851aca70b6680896abe7dee46317c