Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2023 16:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vibetrak.co1.qualtrics.com/jfe/form/SV_9ZiTkwl1LJnC6SW?Q_DL=A1yFB4AgvWeK1Pj_9ZiTkwl1LJnC6SW_CGC_8JT0c1i2j0tCjfi&Q_CHL=email
Resource
win10v2004-20230621-en
windows10-2004-x64
General
-
Target
https://vibetrak.co1.qualtrics.com/jfe/form/SV_9ZiTkwl1LJnC6SW?Q_DL=A1yFB4AgvWeK1Pj_9ZiTkwl1LJnC6SW_CGC_8JT0c1i2j0tCjfi&Q_CHL=email
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394646998" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2091347415" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041809" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041809" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31041809" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067454abe1d381743b6f5ba16996af38400000000020000000000106600000001000020000000813b755bdb48be6904e51054e0284dd2329a526c77b1e79ea2d65ed0e2606e24000000000e8000000002000020000000283b18af125dd2e65cd52aae883482000cb62efa5060cfa8f479afeec56ec0bc2000000042faa176b757363270ee2137f065c2dc6bb28486649d299b633a90c124e5866c40000000b78c21a0318d3785e6fa9a05cdd2543e3681eaba923816fa2cb37d501bd1dd3f1613da008e6507c53f75ce90d0739895505427df307146572b8518b58795d109 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A507E106-1504-11EE-94FE-F6AA226F753B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f3718011a9d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30df848011a9d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2051992343" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2051992343" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067454abe1d381743b6f5ba16996af38400000000020000000000106600000001000020000000e5709257328bd6dc11db4e593c8ec0ad5e895df195b6d4942eb8d42ed787fa3b000000000e8000000002000020000000122f88c4d76bc60c9d244293bae43e2045a88bf449ff3f9280493c73ed89ab3f20000000cd0341e3fac4c860f64d79413dd48dac13eb9a4dd8617f8682367b8e68720b1d4000000005692df18574ddf074cfd9d1f662b06c9f7254a2bf58ba654efaddb7f1ed2d8768a3395f0aecf2d955dbb2548f01f5e6739106574d31a98124a5221188d2834e iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3128 iexplore.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3128 iexplore.exe 3128 iexplore.exe 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1276 3128 iexplore.exe 84 PID 3128 wrote to memory of 1276 3128 iexplore.exe 84 PID 3128 wrote to memory of 1276 3128 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://vibetrak.co1.qualtrics.com/jfe/form/SV_9ZiTkwl1LJnC6SW?Q_DL=A1yFB4AgvWeK1Pj_9ZiTkwl1LJnC6SW_CGC_8JT0c1i2j0tCjfi&Q_CHL=email1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3128 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1276
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD515c9ab555287a59ecb92c5ae1758ca33
SHA158c74300ed36a1eb0f882f5abd2923fbe40c2a4e
SHA256b8ff3db25591419982fd6f38599a97a32af45842c2ab0100cd09a0a1b839d4b0
SHA5123e5821afe9104897aaaa24f7b5221ac3bb26ba92d59c645172529abe88df21fff1104e3ac35935ca6a97def67dfaa5751ad247611278f1c6dfa3afeaca2b9ce7
-
Filesize
30KB
MD53d0abd27c756ad312d424575b7dc3232
SHA16b12b0e563956bd8e1feb0bd6eecf048928e040e
SHA2563d174d4278d132f0821e7981787bb74f0bd9d1960830a01c578a425ec9e9295d
SHA512ecdb5b8039ef65642f540379e7bb13bb6259694931aa4ece72366122e9a9a7401d4b84576f05f5113c3cca086a9e7102059c65504bc7a3e48197da304ed62d9b
-
Filesize
257KB
MD56e967a2161b1a62a75908add2f207c1d
SHA1da7302003532c30ffd4ec544f96783c59d41fa99
SHA256e34ca8a50c443c4a1e030da74301aed53511c5de0e3c9d7374feddea3b0f0cf4
SHA5121523832ed00a207e75db94cd2818d029a9d2e98be20aab44fb5e717b7fce372c39d166dc1e630f0435abc2d621202a281434dcd2c6cee098d50a6e783200a536
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\vendor.254378d095ead39584d9[1].js
Filesize260KB
MD5254378d095ead39584d96b0437285b05
SHA1849ae6e81b7ddd3e3c7e4ec497eb5d9e43d2552a
SHA2560fe3c8d5ee972c1521e05aa37358db25dba8dea89af7e3b0f5c944efb76d96c6
SHA5126357b353f450f4fbf27de801e29a8368fa695922482e356ab8a398f96275c7c00e12c991c5ed4ab1fa27ae6cb6b419cf727d577d819ec522bc9e6ec24685890c
-
Filesize
14KB
MD5521269841ff7f01a1772f3856e636d01
SHA17deb793c8e6cb57c23cb3ad1da6ceaca9982adb2
SHA25665e99ee3b805f7b1c8b08159161e3ad53960640a2c3f952d282af4900d1ae572
SHA512d72849a984866c1ad66b88d3aaae7cff27cac05ece4a491cd7afd8d31a05557e726f502f4223802d10212a1cf8f769c1484263cc20ee1064e3ac2b0be7ad9d67
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
226KB
MD5cb3e897e69285831e4196b7d2b0962d2
SHA14e0ac2085ec60a4592fd89927247c18543352a7c
SHA2569c8b749c0ea35b8deb63f986877f91852362a3a5b7aaa2567933e893cb6bcded
SHA51264b6afa3eecbe6083bf37b8d51e3cd8b8377e4f65c4d0e865c93b19815f2be554b2fdb7290f757e2bc0885f29e2876730b705eb929a708d9ffdfdc1a66caea5c
-
Filesize
1004B
MD590cf29ab19dc601f2e5a9f9b3c4898fb
SHA1a1a366b0bc23887a1f2645c8f68cb7521706d8e1
SHA256c5550d7f8cc83561c801d3cdc4bb3c1784672cf0413ea79b5b32e890b1558c38
SHA512fe4c726a9176e1d379e48ceba881fcd7a12caa38b920604fee157705f4d7f5fab7d7f0823d74fa0a3930755a45ea463658fe225b9069fad99b5566823963a4fe