b547cc10cba116a3c7a237fa5469fc4cd7351a1ab7edfae4147458c7127aa668

Analysis

max time kernel
1565s
max time network
1568s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feniks-site/feniks-site.pl.url
Size

129B
MD5

257ea776cc82c3289c9d6cac68021c04
SHA1

f1777f0290e9a4ea32950d50d5bb04ca2127c79c
SHA256

2a05e363505b5b47eb84568b45bfc82b20b3f8121bd8cf4af2a3d5b065b4c06d
SHA512

b704cc1084f9290037fa08b25b24867be3f228b4b32f9c7b56d9795f4a3b94f1f268064c133321dab94dc66d0df6c29917c6dfe728b74e63e70d8da92318eb03

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006619e593c2762766ad8af75659bd8d3ebd692c8c8714871f293a0ae2c5726ccc000000000e80000000020000200000005e962c5787dfa62591a0a9e03ac8e723c3fbc0dcb88595ed560f7feb17f4d43b900000002d38062043983eaa78428b5d1eac3e2d0aa61ed84c201d7510c33c16f83774c07656464891f7e7544bfbd7d24495be1deda10e92790b3e9ee7a2e9955b13c0f9e2fa1e9cfce7662a2a80917d87a883a8d74ec8e42673b8f49286de93c513b2a77fd0432aafa00f006b401cc15c4dfdbcd84cf0bc1b445b6985e7d89058a79147a81991aedd8dbf16c5785cc126a286074000000028ab38cd798b69bb841ae8938412d65c14bd9c5b2e0f71967dafc818432b2c15c3d74bc50def33c095aa7226065ea61f91fe96822107179713bd1039e6db78f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51718041-A7EE-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b52226fb3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e19a03659174e23334328df7a748e169fee9c5ae86066a7dbeabdaabe1aba9bf000000000e8000000002000020000000c8b5607bf4f2d354ef92cd39b4514f354e650cd6270e44bfd3b62317dff7ef9620000000ddfea8224fa4f708ff5d3971ad0100c38c05059f4eb41648dee68ca4da5e474d40000000323df31f36a621bf6707f8f65e299f0009150c9f4abe0e91c0c0e89ebd458d835e943b1a65fa347bc279fa9509fd10f72e02d59103792b3cf7e571c1d06d5a36	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410197128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2740	2980	iexplore.exe	29
PID 2980 wrote to memory of 2740	2980	iexplore.exe	29
PID 2980 wrote to memory of 2740	2980	iexplore.exe	29
PID 2980 wrote to memory of 2740	2980	iexplore.exe	29

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\feniks-site\feniks-site.pl.url
1⤵
- Checks whether UAC is enabled
PID:1672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa6f5232b288ae576a053343cdc1486b

SHA1
59e3e0018ef67c27107c7cd7917f7c2a34c385d9

SHA256
418bee34f1950a6fb0c9a9865f63e562c1c572756d609f623a547beb5e3a9b0b

SHA512
4f4a33589d15d44212f00f3abae86b7334ebb2a8388f9b87ebf9cb2817f2b80e62021734be28042016867e048bf6168d22170bfd56c84fd2aaa6b95bc75366b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aa548a0c30331e3f78d2e46606d7606

SHA1
3908748b78df46632950aa5fb152f6a25719fb36

SHA256
365d018706d5616bef28398ecebdb442b5b864f7e470f695d773ad40d2f69603

SHA512
1dcc66b3f654ded3d5e2e1a74226e63bf1c61cb94043728a1989fbcc7daa6ad480b5cd626666517ef9b37b38642c7094a38dfbfae5d4b84ee8a1493940b7ac91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e9253a645185fef1783a2704ad7afc

SHA1
1af9abfe7bcbd8805011f978385ef40da1378690

SHA256
62c12883d4ac07530f2397a0c9fc05f2ec802e068da7bfbf6e9110878aa4e2d4

SHA512
fd60a04467993627d41211b472ee3926c9a44a9c9706cc8c1b08c9acb09c86574b0a52d4705be5ade9b77cef8fc206cbd46182454bcc990d0e14c05b87474185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d572463bdb936ebe5cfa609b6cfd46

SHA1
ea3f474fea38b65421b6a7b2eddc944b7f9e8f8d

SHA256
5984eb23daeb455fafdc5b15935baac6095e69f426d756d9eb17490ad082c5d1

SHA512
8847bc37e75dffabbaab623f71d758239ac339c5fa4b156c5d3cb6e94145e1a22457692293081d42a861dad0b358472d077caa97fc59fc81550df6a8b2f36be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe07050234bd74a708be42664e8afd1

SHA1
d462f09787d8b06d15fe8e54254a2117b9c85140

SHA256
03a4a165ee401ee3ac1cd29d89809ca569611e93259a0eb8083abd27f2d216cb

SHA512
d71497cc1ef17ac921c6151b59ea49a49a36c6bbef960256df3df2e4f4e396d0917201d7bc0275ab019b9ae746be7d5df0635cbd8d1b0cd875a44b62188dde0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b1fd95140c1c784c5b4afaf5fcdf87

SHA1
8aa1e67cdbfe06509dacf8240924364dfaa9c275

SHA256
42ba2b43493286494efecd6ecd5968f5d716c17e212fe63f490a65090f979343

SHA512
cfbdfb948fa953f9d610c031e6551893000b78fd76e9a381cb86fc7a5d91adae2c6b05fba587730314573b797d08719b059cb3519a63ef737068d6ab127c9018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EA2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EB4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1672-0-0x0000000001D30000-0x0000000001D40000-memory.dmp

Filesize
64KB

Download