Resubmissions
02/02/2024, 00:48
240202-a529jsccbp 102/02/2024, 00:48
240202-a5t8yaccbj 102/02/2024, 00:45
240202-a3333acber 1Analysis
-
max time kernel
7s -
max time network
8s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 00:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.google.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://www.google.com
Resource
win10v2004-20231222-en
General
-
Target
https://www.google.com
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{576ED621-C164-11EE-851B-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2016 iexplore.exe 2016 iexplore.exe 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2656 2016 iexplore.exe 23 PID 2016 wrote to memory of 2656 2016 iexplore.exe 23 PID 2016 wrote to memory of 2656 2016 iexplore.exe 23 PID 2016 wrote to memory of 2656 2016 iexplore.exe 23
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d2b63cb2856bff4555fc876cd72d96e
SHA130a02d0d5ab14e54ff5d6ffd8e83faeb53ed5789
SHA2565fdcd9faf04aa8fe7144122ce1aca3b31a592c96aa62dee33beaf237a662665b
SHA5129a21a671d4e4f5446df215bc93e8176a57ab478499fe11f802eed42ab00a5aeb4f246097648667d0bede59d010eb0ddbf29c7f79fddf2a0bb4e3c07bd48bd076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b58faf985bf797417ea855aa8abbaee1
SHA10ce7ea2eab1ae3b767e55e438f8a97271ef9146e
SHA256d52af327fee9859b242e9173d17fc7903f6629da0e7ad151c4044b8292826b51
SHA5120e6260dc493f62a04fdf6e815f003ac18e2f38df59ae54552f6729065c58b473f067bc0b8728376f3b2da267855fe6e51378683ba57dc687e1219d02a106a6c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5249e106a915206b34f2076291eac82b8
SHA190c6933daa28941bf2efcc03b93474a94949ea5d
SHA2560baab55dc2833e2111e795b64670534c88dd95ca0cd2e7d850fab3b1ec24e5ce
SHA51287dd2ba69e763200fea0d30e4a62194ad70d1bc6e1aad161a4d405b4029a9be1b43191fa3ecd0e36de24cefda0bc63e955b585dd5470746e5effe325bca5cc36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b1b14f29d66e876b9a6a1b91193d3d6
SHA19bb08b8f714a22b3023ce63a0a8d2ad57357622f
SHA25631b81e78cbbfd9950d4f50c5b1509c3c8c201d1a10c5d2eccee550d9d4cfeece
SHA512ec1630ac19a3a3af465c2155e9698dc890a34f8a27438ec3d2dbb8852373709dc1a38dadd20f3b7975e1f61f9051b62e98306696559e9cdca570d49f8e98d8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571745bbef352ed9f34fedbe185e93206
SHA1a22c4328993d237a8662a465c0d31124bc295e90
SHA256297bb8312afbf4ca07a68f4a6e4f9dfd5ee9bae2a806fe0eb385c6da2828ac6b
SHA512b9453e7500dfc5ea7377103f99d031df29175495667420b9d95a2fc9b1e9c949af8612c11681c80568ccdb392f613efdf79ca331e8d702d6568c604b1fe76456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f68e8450caaa1187561d25d46dbb03
SHA142a43106a01cc329287ce7969e4edf597ce34e82
SHA256514b736f813addad89458c70296641aa45b8a1c1a860d9b8a505943858ec0fc5
SHA5123ad39e0da9501197b2fe2872d3bb62cb3adb76f3c003664e907ec31d394bc277ccceff5f5972a1cace93f5512c1c8109d706dfd6de159cf6fdfef02d07a9619f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e61fd54b0d651da57307764df33c1526
SHA13e71d42e2d3356c2a489d7d4660f78f5a2c7d512
SHA2565c5270ad60a2870e28149bc2ae8f725054c373a6b8c2244f5cb7bbe7e3ea0d44
SHA512b35a9b88582ac5ba9d4e434230b6954564862559c89955698349e29b39fbacf06e3d6d84ede23ec776269c28bd8247d5566be3bec75ebf34637ca00775d32350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7ef2fb4339b4fa3c534fcd3fc261176
SHA1a39595b5985c0a1c429d0f23186c23cc9dd3d43d
SHA256c56018acbefa908157f99bab9da3170b15697c3bfd2d8e57d79c64a3efcac189
SHA512c394a25efaae352e83e250987a3312bb36084b4b8399a3e50fbc7f87e2f61b5f02fb2e399882315e29f60e19d8d927493d2536381eb8b6daa286c424cf4512a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd541b80358d4c11ba2978c8d682e441
SHA1dc8a6042f292558a7b7378ea3d10ba4d1d850e70
SHA25684fdd5607dffe4e4235fb54aecf6e8d8784cba5f57e0b44739fed4620848b987
SHA51298daa972dfe373620f53a82bd278df2c2eafa7570130d947429d35ebfaecf573369d20c891705171caee42fc1bf1e388d35b88de7577db22f7cda9ae5f81aa4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddb5e74b8ccf81b6df7c83b8ca1f6e0d
SHA11f8af69a8f5d1bc078a82512ed3e892303b0330f
SHA2567753187da4f37d86d00c74f729715863cc9b37c0e625af762bd61b03d73726ed
SHA5123d0a2eb28330e35a537620d4ae61482ca5e08601560321dfe31e4e61b6f02c12b587bb74545421b19892f76938e08454912f4225fd29c4a1b2e5ddda2fd887f8
-
Filesize
5KB
MD583b8c97999a419c6d3c92db6a4d8eb8a
SHA1559234bef466a53a4986a560309fb189efcdba61
SHA256d22d1e6b1698d299e171a74dc96b91b4189d663475fa6fa3946f7d8d3670f5bc
SHA512b6e5e554b17f96efb4093624382c5c80909a42125f36ea6f2a2d94270ead54a82bbcdd91e0ca0950871eaf9253f81b9d70d9084ec314b46d670df122fdd5594b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06