Analysis
-
max time kernel
117s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
3ff64afe2b516d3fc226944679301231.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3ff64afe2b516d3fc226944679301231.exe
Resource
win10v2004-20231215-en
General
-
Target
3ff64afe2b516d3fc226944679301231.exe
-
Size
360KB
-
MD5
3ff64afe2b516d3fc226944679301231
-
SHA1
4419e2feeea5578dfa5b6b9c068e92137bb3cef3
-
SHA256
3f90e762c6bdae24abe203e8940e39cfe365e0c0a17279045dc10a58942ef7c9
-
SHA512
164a1dbb53adce7baa8775b4e33b039e216a205c157e69915a5312a04856acded07e2b39e4a90754fa06da8763f9749e2143a39f2d5172be92e3f3c20257e487
-
SSDEEP
6144:5M6wd5jmLv3EQTIJ+IvcFm9AyvYwpJ3da8gQt6rHJMj:5M6wda3EZrKyRgh
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000003be19d3d1557aa435c9bfb7269f4c69a220b66923b1338188bab7b451476a99e000000000e800000000200002000000014b9d9b1e06b9de767161566d16cb6e97e4ae80a3ec9ddde2f0609e3fee052e1900000003b518693c814f1dc7dea039f3526703a50dbe3a6ad09c76d800ac7cdb05febcf2ad6c282d5f676baaf13de3bc15f904257a0f2e51b81c43736dd547cc526677d7592e699216bd92e18e3ce5e38820596ed8d7deaa058e54d61470e87197ae6f4d9f293609ac0a63a44538773856601d846c048ab4d70595ccbdbd8642260ca31dd8e8afb52c31e3b1ca29ee2461d2bcc40000000c012a59ff9da5ad6048f1c8cb2e3dd6bebeb257661ce8e056db45d09c9009568681f05b3ae3aee51feb235f9393035555ac4f6910fd02d6495ec20f8e8179c96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000057c47e330230352117ef02c69e86fdc4128c864a9bfc3174c98931d2c8441083000000000e80000000020000200000000badba5f7dcf49144837d52c0b44022f3be7317c9d5d830871bdae693c6c9928200000003ed426f7b8b12db0db565b8f22147709de5da31d10c65fe7c529bab59fa981634000000079373a35a3c72addfb5cfd92924c776ba3d0e4e435fde9a70ac6b799af75caea651dea865efb015d22116f81d77965e6aee5c4b4e47ec3cf7b91412401690b5f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101dc31c733ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{482EFCD1-A666-11EE-9066-F6F8CE09FCD4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410028743" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2696 1392 3ff64afe2b516d3fc226944679301231.exe 29 PID 1392 wrote to memory of 2696 1392 3ff64afe2b516d3fc226944679301231.exe 29 PID 1392 wrote to memory of 2696 1392 3ff64afe2b516d3fc226944679301231.exe 29 PID 1392 wrote to memory of 2696 1392 3ff64afe2b516d3fc226944679301231.exe 29 PID 2696 wrote to memory of 2456 2696 iexplore.exe 31 PID 2696 wrote to memory of 2456 2696 iexplore.exe 31 PID 2696 wrote to memory of 2456 2696 iexplore.exe 31 PID 2696 wrote to memory of 2456 2696 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff64afe2b516d3fc226944679301231.exe"C:\Users\Admin\AppData\Local\Temp\3ff64afe2b516d3fc226944679301231.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://127.0.0.1:8081/exitpp.html?2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5333273c250a7ab316afa8c41f167f551
SHA1e0e2a0ede930dc7c3970fcbf70eaca63e5376f19
SHA256e8f3f2cdbdd5d0514e732708059588879226d7248fef8a2556b3b6c67e74b50b
SHA512fc50d6b209f94817c0f8c442abe228fb13918e78087cd21a87fa34a10f1b5f79c9754c5b347652aeaf0dd1de1e4cf6fde4711035ab987a6ac9bc0a243e58d170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f76757a4954b7b35b55538eeafdf98b
SHA14a4591569fd888eb5faec2e910dd4afac9e34cb0
SHA2566a46c0c58382f3eaff3b090141bbc9c06706dd43dcbbbb52058e26b911cd7a9f
SHA512b825b4439744f3dba674c27fba0e4f74543c975d56b11145d5adc9ec4bac441ac7f62883fab96e77693d724bf03f0e97f6b945c681494255dfa3a98addc1ae9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9dc7eade16dce036c21e0f5c8ca9f48
SHA15b7638942f44c7839d71f206a423672cb61b04f4
SHA256a5e5f448bc114d27b5714596f0322d2fc7741373ea4a16ca653b2e8f242925f5
SHA5122c2b32979205aef7c3e4473f5cdcb1e5e12b865cceda082991160d46497a9300af19fe51383d3e23f886aca767692e6c6e2bb273adc74e8dc89021687ab3fc47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568c4b15700b9f6a5f175472c8c17dd45
SHA1f30cefa1bb71fe5ecab8c48e9eba96b1d6dfc0b9
SHA256c9abbf0371cdeb48967d606cd5630e3c9fc53544c0c1adc82d6f5981658fe504
SHA512b9d2163d66f71486d18180311824e95ba998e8eb47ba3517351d3d0d13958068465304bcfda555142b831541f53d8f96322619c9625557078a960932c91e8ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561c4d5ef632a033f8328a4ba16f8ae0f
SHA146e51290d948080b7bb6ef9e0d117fa27097378b
SHA256db2c5651b06eefec7a86bb35babfd608242ea1042ae73330c49521f3ab00649c
SHA512b521feac57ccae5b3ca7e287f01664d56fc327d7f3e02471b80681aca196ee797833128f0935266f58ab8e8ffe6f9a5991ba670557e8a086df367c267f22509c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f850dd4f8f4a6c2170b3c541c6d45dac
SHA1bc11f54a7c40ff80c1a45c33671238b73e72d26d
SHA256bff1ac78f8e959276ea41a7b8a013fd6885d49c4942248e801f0f8dc2647ce79
SHA51257f63032159816b18206c32a639508cd697d4232a70f70dfd5b060d5a5c59a35dd37294b32d4b00abe056c754fdea6190d2f065a37d172b418b5339c57030726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea2dbfd2580381e90226955bf88ab13
SHA1c270c8be64e77183129f9ae4f9cdb97d917ac820
SHA25612a61c7a7df6d47cea9a2e89d0731b0ed6798ce0522c910855d5a94f7400e5aa
SHA512dbf302ccbeca2672501e6da34930c0e6022db03ab6e9ba09218aab6730320412238582efd03920cffeccd7ec54337616d57cabb8c49b14ce13ce458826e1622c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e73240c3c3856af1f527cd0571e73a8
SHA18482f1665e9da44d68de4b8861f1234ea366bf6b
SHA2566c29641ef721ff2bc42d93b8402c7d550c822dbc276b5857f0968e23cfdb0998
SHA5125a2f6389e1aab8ed8245136feafc964ed4d8583876b9870bcf5efbd9a1afb3ba2899b1737d1b45f99ca0f6ebbba222fbd00fc27a4baa37c5350ed0e29e83b5e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f93097692e8f42a1e2cf818731adf6a1
SHA11b157fab2b56afa7a3ff9182c8359637a4fa4df4
SHA25632bda271221ed6643eb5dadcb3ab0b3fcaad3bc1437375eaff27268b0caa7414
SHA5129ab90eb3b1ec1129cc1f26c27166c1652ba5959d5295a2206db4d81f30c75c0834a77fe62c94dc78b864a88fff88e6bd1071e8c1ee3137382b25b420befcb3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589550657027a2ca834c04c9ab73a4f18
SHA19550b2968c0ecc57e6da5b3b42e5bef31ed319f2
SHA25617723bb0441159f16c4a1a25f76847f376849d9070d3ae5301acbf1a245b2e6f
SHA5123731628919ce25b2de325b52390d1dee351a29883c3a5fe5bfe39d0c5a5e7545bb6129ed97c21cd88846de58d1eef72051ec9bc716ebdbb1a4def2dcef73ffef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586d26621e0851481c1ce11d12e8a67c4
SHA169026732eece5aa6d33b5d7598c18e8b02870eb5
SHA2561ea08f51362f142bbb6d846673889af630bc79e242e1626a81165c019ae9f43a
SHA512170968eb400b7f23d12000255aeed1f3f4ca66d234fb8a87f4e29fa0d9edbc1ababe18f487e010c73c9db9ac901314ce9c04849e2dd680a639f2454038da1bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD530605b621d7f9aa7edb6521359398e6b
SHA15622ff97307698b0c9c1bc9bce71679c23414b5a
SHA256af48c2674d057d50bea933a35b4cd32f316f8321b9661010ed0d472bd2f9a0e0
SHA5122a60bb9190f739bcaa17bcebbbf4e8f11a0ddec9f7722b79aad7c7abff12938118c37c17a4b676466f2f7db9f33553c4a116d4a22846a9d8ee5b6e739ab2cc20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06