Resubmissions
29/06/2023, 15:30
230629-sxj24sef71129/06/2023, 15:25
230629-stps7aef61129/06/2023, 15:22
230629-sr38ssdg33129/06/2023, 15:17
230629-spgl1sef6s5Analysis
- max time kernel
143s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system - submitted
29/06/2023, 15:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://e46262ec.886b69f668af5bae811868eb.workers.dev/
Resource
win10v2004-20230621-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target https://e46262ec.886b69f668af5bae811868eb.workers.dev/
- Sample230629-stps7aef61
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7015bf0a9eaad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042206" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042205" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "7175619" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394817300" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067454abe1d381743b6f5ba16996af38400000000020000000000106600000001000020000000595d4eaa941cd85600d922dcd3e4fc24ef6ed411db9c4be960f48008103fae1c000000000e8000000002000020000000350ac93724729aafe660bdb060d8cf7b58e284c57f6e9e0ecc27054edcb1cc0b20000000c9929ac716f900b0d8138b43e048def82ff5e3717643a786a24b6ab428a67bbc400000004ffee700c15a75d3f9abc8c4c99ccbd465ff4e7d08b397ec8bce7744c3483e3c38d50f1e3b4ccdbe94c3c7593fba0de37e5b571301c77a1bbb1864810f3f9c17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000067454abe1d381743b6f5ba16996af384000000000200000000001066000000010000200000001855ba42b9863a50ec9e8cd3761ba9c7c3341082477c8a01f7bb202bede38247000000000e8000000002000020000000cd66da30c48f1d004ebd91283e93b77dadfb8676ac668c88a3afa851be938d832000000060d157060e15e23de416383ff4410ef9c5e6ac9da508e2fbaaa4ef7669dda3e940000000abcb5f6e0705388534ab1bae935528b32c79988bcc8134523e84aa0204ce731884f66f999fea4ec72546534a611e06ce0a02583a0e3965f3124a9be092d206d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4258078145" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3072d40a9eaad901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{29223EDD-1691-11EE-94FE-422BD5BB252E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4258078145" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042205" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2268 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 3456 IEXPLORE.EXE 3456 IEXPLORE.EXE 3456 IEXPLORE.EXE 3456 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3456 2268 iexplore.exe 86 PID 2268 wrote to memory of 3456 2268 iexplore.exe 86 PID 2268 wrote to memory of 3456 2268 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://e46262ec.886b69f668af5bae811868eb.workers.dev/1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3456
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F
- Size 7KB
- SHA256 50abe1a73ee4a6792000a26df70537b6d4a65ada015856c2ded0f54dc9af1675
- MD5 a786d98fac4b086caed1b90be7b958b2
- SHA1 fa964f600c3ee4e06b50d82526bb5ff26628d40d
- SHA512 53944582a5c09d619bc9ea5df8755a5780803bd0998a5d88640e90451eebd464669a08e6e00dd67375476b5af63d022f4a376c503399bdea594171cafe4f97b5
- SSDEEP 192:Xn2CIqKqgpho60nYiU76/U7wIvLSyiFDL1F4U7rLlSK:oqKq+K62YiUu/UE+ixx2UrX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
- Size 232B
- SHA256 c2eac0f519a4cef823ebe69c3a0cabcaa88f40a3dac63c3ac80f7b5d14060eb6
- MD5 570363454315877ac8daa00b7e7ba14e
- SHA1 d14dff69d1eae6b375e8ce00c7b91586a7a53c4f
- SHA512 3b4a73483b0eb5088f63e0b0323da185d5a7f55b6dc7b8a6290b97fcd81ab04d8864cdbb090b1514b6b4ff4ef0ad2f4129aa1fa123886475592570c8a37755df
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\favicon[1].htm
- Size 3KB
- SHA256 e15ec89248cad36945d5f5335b5db1064c0ab8cbc912a51fd0557a44f968eb62
- MD5 9acc93d2800c0e77634eb418826706ca
- SHA1 969e35f05510803c8a48d0e75cf12486175c53d4
- SHA512 8f5e469c7b50219243b1e73dc7218546ac0f8f7444eadd495df04c7e4724ac5dd557bc5e055c9184b6a9cadb2ca3e3d490bb5cd44613da988f23de6b1fc41879
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP