Analysis
- max time kernel
136s - max time network
155s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system - submitted
13/01/2024, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nezur.exe
Resource
win10-20231215-en
windows10-1703-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
LICENSES.chromium.html
Resource
win10-20231215-en
windows10-1703-x64
4 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 5.2MB
- Sample240113-y18grsefa3
- SHA256 dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463
- MD5 df37c89638c65db9a4518b88e79350be
- SHA1 6b9ba9fba54fb3aa1b938de218f549078924ac50
- SHA512 93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67
- SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45104E6A-B251-11EE-B6D8-4E2C1743BD6E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a8d4a6f46ac4f46b2928f563a6832ed0000000002000000000010660000000100002000000066b205621636f933b21cbee0f9fd0974567b795da45857958d7ded03aaa2dbf8000000000e8000000002000020000000ffeb317ac1b42d274e74377e684f2c57a23637fe41c4ab66c71fd86b95c5e737200000009f71acbf46b369eceb9a123d958ce299cb27477a2e4ec3cd8107a0aa19e9ba13400000001f66b12bbd208ed91474d86e32c38d51c170934fd7e01a881defa47f08037551fe80bb549055b334d7bf521977ab9409c1726975f979eef4c5eeb4f0ce4e61c4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ba151b5e46da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a8d4a6f46ac4f46b2928f563a6832ed000000000200000000001066000000010000200000006df75e3139f1949c0c350016c9d09341adc6a4f9e3cba2235125a000d2d2d583000000000e80000000020000200000008d41f5189910a3fd14d557e8eac92749ac360ebf8543d574552449b853fa1bcc20000000b447e2296fb45576c2bab805a3bf2cd127d0fe81f1b007ff83ba935fd7e3741c400000004ca8909884227a47284a79b6da0637179e6bcd33f9ce2233d2304cc267e4138e0242b4c4c5770a0d04c3628cdfe71be79c8fc8c95c1b7f7bc03e13d4f678184f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411339139" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50aee31a5e46da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "411339308" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "411339196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 216 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 216 iexplore.exe 216 iexplore.exe 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 216 wrote to memory of 1368 216 iexplore.exe 73 PID 216 wrote to memory of 1368 216 iexplore.exe 73 PID 216 wrote to memory of 1368 216 iexplore.exe 73
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:216 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1368
-