Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ci6.googleusercontent.com/proxy/C3MBuHyWVeFPU-_nu5boEJbpf8hZyywcz4mxsuDlxbBJmZ9HCBsy8W84IR4LCMtuqzcb0mQ3BhpBa5yy6buOkMrFjo9ozfOE3wJfDw5F50bS1g=s0-d-e1-ft#https://eu.docusign.net/member/Images/email/docInvite-white.png
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://ci6.googleusercontent.com/proxy/C3MBuHyWVeFPU-_nu5boEJbpf8hZyywcz4mxsuDlxbBJmZ9HCBsy8W84IR4LCMtuqzcb0mQ3BhpBa5yy6buOkMrFjo9ozfOE3wJfDw5F50bS1g=s0-d-e1-ft#https://eu.docusign.net/member/Images/email/docInvite-white.png
Resource
win10v2004-20231215-en
General
-
Target
https://ci6.googleusercontent.com/proxy/C3MBuHyWVeFPU-_nu5boEJbpf8hZyywcz4mxsuDlxbBJmZ9HCBsy8W84IR4LCMtuqzcb0mQ3BhpBa5yy6buOkMrFjo9ozfOE3wJfDw5F50bS1g=s0-d-e1-ft#https://eu.docusign.net/member/Images/email/docInvite-white.png
Malware Config
Signatures
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 80f04f59ab4fda01 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95EE18A1-BB9E-11EE-9028-E6629DF8543F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412361899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2056 iexplore.exe 2056 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2056 wrote to memory of 2500 2056 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 2500 2056 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 2500 2056 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 2500 2056 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://ci6.googleusercontent.com/proxy/C3MBuHyWVeFPU-_nu5boEJbpf8hZyywcz4mxsuDlxbBJmZ9HCBsy8W84IR4LCMtuqzcb0mQ3BhpBa5yy6buOkMrFjo9ozfOE3wJfDw5F50bS1g=s0-d-e1-ft#https://eu.docusign.net/member/Images/email/docInvite-white.png1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD58fa7baad3eb728a135fd8017a2d2ef7c
SHA1db8a261d188f85ccc2136bc2901a10c0785e2eac
SHA25603fa176c41aa64a3f1cf2ff038ddbccca47641817bbd907956476c5d33582755
SHA5127abdab7d3279b0eccd9c90edd7ba4d1d591766fab37c53e6e4ab1ba28c16d99be7703d4437c8200aa0e8c152652fd3c66b0254344859ec4c28e9a386ec28e4a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD549f6ec19b2e0a897c3497b025b8f514b
SHA1f41561e896398cb102e55495707523ccc15e2db2
SHA256d05394adce5e95d689dbebe547b20609cf392588109771a729c4d398d20fe92b
SHA5125125c53c03cc3546caed21449066e63a27617a92491c26b3850b7c5f13be5409003f1497df4898ac858a4d21adf06b97b74ddd5625ded6bd434ec7a5b18c4707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dae659689f2fe50104e85a94943d4359
SHA11ed6e4a518dc2d92a5b53f4cff794a1c66d97ee5
SHA256c53d307a51b892537f7aa61db5028d2badebc555c0d26fac62607064c927f4c8
SHA5123142ce71f40c11f30b7e7c53bd0ec6e6f3d80f6f16f6d35e018f9b401b5be6c7fe53a1e39a788a1beb9f7ed1e00ad18ae9adcdeca4a02b0504c3cb6945901a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d331cb1356da1602dd8fea38b83b977d
SHA10d3c4c201ab42381c7f633d1773166f9e2b0fff8
SHA2568ea9ddb7ed778b3f25c7160acbe0a650202c307052381878ed0c88282c6e576a
SHA51254f9ad9b1f431625603cc67653cdbefa77996c37317bfad32aeee0291749df24b95c642b0a85c6538b304e60fe9a38c4863c629f8d4ad8507431c15fb51b182c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c2736fa761af1cb395bccbd0cb187ecc
SHA1a6a6c59da408a82042260a8c3f5da81bc9b5fd5a
SHA25647a4a8ac25217d1aceeb55c4e4600d41a2a066896d60c3d43ac85eb05c44a36c
SHA512dea285ad83a0d6f361881f30303dd297e67c5074dbece42be36785f7bfd43e3c98bb8f86a6d66c9cbda2c13afed5bd4a539dd3ade88d3c6a765e58bc36d805d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d36c0f6769bf0554cfd5cfce10f9729c
SHA16637a69c4900a5f67b91757c9924e737217e9976
SHA25650908b0aa86dcd93b77d387ae24f97b16cd388022e49cc02a53b1cea74578413
SHA512d22f58871cfdbf84f235853e091bb13dc3b3f73459fee3bd0f5616b8e19fb99a3e59ffaec04007223ca5ff94662813436c414ea3a00769de5a53ebad35a93d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f0d34b643e456512af154372571f8dfe
SHA1324b3d112ad567b27c8f81f066c57074286c5d1b
SHA256c5590161f010fdb2a19a34aa70229e353fdaca7254c3cba04935cf4f7b4bc486
SHA5127c8b41fcf7375e674ff75b69c4b29049f8f63b13d6c3d0d62b0fe7e40c25660545e6ea9843d175525d9ba8262dc696ef2b1cdf281288d6b514fe365de008f99d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51010021d9aa71ab4dab5f19f9640c2dd
SHA18c2748b8d3654fbd33d794d6f83033b8459af0df
SHA256bafb1696ca351780239143eff31cd0393ec603d6732996b8369d44cfa6b4a877
SHA512cfe5cbdf4baa62a26b2166720ab0945e4d512e17407f46c53518681eb27752a0b690803e549d89d55f0822a946f09a11394af8ff272e4bebc69292f8181db737
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD530e1b09376c2c66517a43c3f3ecf8594
SHA1bab5017f91c4b2ba16c5300a39b656faab6596d6
SHA256249eda70c701105225787d2aac0c2d4e96f1b94f4431ad3a91c119346bcfc80f
SHA5129487d8fa32e470cf4bb392a552df5809a53a2464610e9be4841868af712fda71c9662932620d22f34b074730bba14d43b30c9f44a573ca021717823af2a0387d
-
C:\Users\Admin\AppData\Local\Temp\Cab2FA8.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar2FBB.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06