Resubmissions
15/01/2024, 17:23
240115-vx8ftachg21015/01/2024, 01:06
240115-bghexafdb4615/01/2024, 01:04
240115-be8jbaedaj6Analysis
- max time kernel
42s - max time network
35s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
15/01/2024, 01:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0
Resource
win7-20231129-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
300 seconds
General
- Target https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0
- Sample240115-bghexafdb4
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000ffab7f3cdaf28b6cf586d92b8da6cfbbf1040ffa9461ad2f9ef16a9ab22b2792000000000e8000000002000020000000fae405d283fc8fe3bec284ac1ce860f96f57331ae61f49a233740cda68a30130900000005b594cb8ba17b238c3dec984ed1d89f852781811380beb69cf680891fed9a8a390fac4e558ff60b91aa0a8c1f9af39b8fbb8fe6b982cc8606b25cf82aef403b00b930fba0b04f11154c791803d4512cdd71baf34b62e7eba756b1362f6ab382419df88ae0f318075dd4f073d44d07ce7793489a9420d7a82cbe5371c993c7c2419219da950c437e126fe430aed5734de40000000f993667105aa9e50eceb59516324222aac3cbed2caf8610b4710498853d4d72cc24ab5b603b2a2c2d7fdb4c36d7b0e6c2a32bcbbf98c031fe1e1ffa60bd130f9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000002c0729fd31b1d9f1462eba199dda6c80c2bb7a902c2079bc6ff1e091c9977073000000000e80000000020000200000009ee87d21a61b2bdca443a880599c28e848e7a100db4e05a4a7bd18865b5a006b2000000095d484b6ee25da3c655b127fd95953e6dd1b84d1dd2bfeaace2d01a7a462ff3a400000008f0aa694ac66f4605c00c3ac139bd7d0d7d00f37a737ed7caf50db6ac3229a5229211e34b3d48142a102e36d27ca62a647b7f52c733569b90d634401590e57d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a8a83e4f47da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62DE10F1-B342-11EE-AC1E-72D103486AAB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 944 iexplore.exe 944 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 944 wrote to memory of 2228 944 iexplore.exe 28 PID 944 wrote to memory of 2228 944 iexplore.exe 28 PID 944 wrote to memory of 2228 944 iexplore.exe 28 PID 944 wrote to memory of 2228 944 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=01⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 36fb7589e0455f34093d95e1a3f1a0a38a8ec6fd09055f7f365012ebad0bc57f
- MD5 2c717583c2d8e050bca8ceb715bf2723
- SHA1 1a71391d609a00846f40d79444d26fc9327f19cf
- SHA512 b4ae47f9c7c8c0eca27ade93b9a1bfa72f3bcfbbc75d13e646b5c8d76a5763ce2a734d5b279a9ef715d1ce26a69f1305a4cc92ee84b5938919ee4cc879b0ee87
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8fc8b6adb3bc6128e2ac832aae81fecdfdbe384f512b295acf1a0f203c49bd44
- MD5 6a8c01aadd8453606bb67a780969fb44
- SHA1 92cc69ecda98d9891566c436e5177d7131e0a299
- SHA512 b1dbe6f6bfcb60b6b98156e5d74e36ad0afb158d38dd12b8b2ce906d01f518e236faee31c5d867b6ee2bb51f1ed714c48442b049a9f09ecc52c9fc78d0d7846f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ceb5bfc49d0b269a360692a03801d3e8d1f3df1f48a1880ad153a0327528b11a
- MD5 957f4e50b4fce5fc814e1541641bfc61
- SHA1 33b1e9f836456f7d1f149902e641f81b24cc54e8
- SHA512 b52f735d7c44503d48edc352086c6f36d93238bc45ef83d0ff77c4a2c29fb3274f9389ff1a75752045c94918335cb192d430d56681fc9ecbb38c251d4d5d3608
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8dcede7870ea6271f5a78907cbf3bc5bc42e6767011c54a7e116b2abb828a1cb
- MD5 4f71855cbdb81bfd2d2a52ab74e6589e
- SHA1 9ab5f00d7616c85b431c92766b422a60543ec8ae
- SHA512 e6af4aebab8e7d132c8dcab99e8379456b8bfe56e35c185e3c86a6a6390b9f54d6af4498ba53a2e4de4dbedadfa7c57bcbdc1ad21c7ae022090bdaa05dc4e7ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b710d605d1b5acbe9ac8ca1233163c5740eedc2db22f0cb23ac3ff2f8e70239b
- MD5 63afeb25a351b75cf5cc055c19a6d082
- SHA1 f2b2fff2a4b899cacb9b3caa3121bbd71d82ccb1
- SHA512 51f2060fc73141abb23d6536562eeb4986513c6a80dee938e5f2a4f68f1fa64f8d76c1d9af03a805a1f70cda51804fa72a1651f5fb7ef5474e977b0d18c0296b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a0bc6902526c6733d7d2d3dd3c243836917f27259182564f9580b819bc7eb54f
- MD5 a1b2460141b4ecb489e6c162414c0204
- SHA1 8eb41f3c93e90753ef53d8a7134759351d01ccb5
- SHA512 18f7bf664cd7775e127b1286a7a67324393a9bd726aec0741761fff60d108d202f9fd70ac91753d0a6d8b8ba27d8e7890bae965353a0ca731145ca8474bcc5fb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 f8946790726881a171a21844a943820eaee4012165aa9826a30e353de30b7dc7
- MD5 43cf9834f65a1c14fd9e2412259b53da
- SHA1 1ca488515bc5a70ffe1666c2b282502f1ac5d732
- SHA512 637ab5037e757597924ddf435161152f2ec1fcdd358e5f53168635b680c2ee418127409a9d3f0003e381cb11fc340f8d733f29b5d002a6702493cd82b7d6dec1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat
- Size 5KB
- SHA256 b5ac004a875c5d4ee638155ca37c71406dffc16e95d77885ecf4b8cac7da9aa5
- MD5 4dd4b78f67b1fba63bd0a79a0bcace24
- SHA1 1b3ce8639e3a3362af244de1d9d2d7b2339ed25e
- SHA512 0b6457c2089e08d90cf8097f581faa6941094e8dbef0e4a281d91dfb4e015692eb79d46cce63d7cd6a31f4333d275a6d47509db3e6a85c0dfa8b89265f2ede06
- SSDEEP 48:VqbDaO7IJct3xIBqbDaYxG/7nvWDtZcdYLtX7B6QXL3aqG8z:EHvIJct+oHP47v+rcqlBPG9+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4GYNTMKV\favicon[1].ico
- Size 5KB
- SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
- MD5 f3418a443e7d841097c714d69ec4bcb8
- SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
- SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
- SSDEEP 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A292HCD1\analytics[1].js
- Size 51KB
- SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
- MD5 575b5480531da4d14e7453e2016fe0bc
- SHA1 e5c5f3134fe29e60b591c87ea85951f0aea36ee1
- SHA512 174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
- SSDEEP 768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1CC9.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP