Analysis
- max time kernel
121s - max time network
128s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
09/06/2024, 07:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1249082929209020497/1249257330504237116/Neverdies.cc.exe?ex=6666a50d&is=6665538d&hm=07454d5aab08f18da7396d984b9f34a3f2d3ce93a4f9d07767153a630fb34589&
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://cdn.discordapp.com/attachments/1249082929209020497/1249257330504237116/Neverdies.cc.exe?ex=6666a50d&is=6665538d&hm=07454d5aab08f18da7396d984b9f34a3f2d3ce93a4f9d07767153a630fb34589&
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://cdn.discordapp.com/attachments/1249082929209020497/1249257330504237116/Neverdies.cc.exe?ex=6666a50d&is=6665538d&hm=07454d5aab08f18da7396d984b9f34a3f2d3ce93a4f9d07767153a630fb34589&
Resource
win11-20240508-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target https://cdn.discordapp.com/attachments/1249082929209020497/1249257330504237116/Neverdies.cc.exe?ex=6666a50d&is=6665538d&hm=07454d5aab08f18da7396d984b9f34a3f2d3ce93a4f9d07767153a630fb34589&
- Sample240609-h56kzagc35
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 90a9d9863dbada01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424079503" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C38FFD31-2630-11EF-A40F-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2476 2992 iexplore.exe 28 PID 2992 wrote to memory of 2476 2992 iexplore.exe 28 PID 2992 wrote to memory of 2476 2992 iexplore.exe 28 PID 2992 wrote to memory of 2476 2992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/1249082929209020497/1249257330504237116/Neverdies.cc.exe?ex=6666a50d&is=6665538d&hm=07454d5aab08f18da7396d984b9f34a3f2d3ce93a4f9d07767153a630fb34589&1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 19192df8693c5c17645ce9e5646f5d1d24773ec52b4c148d3cf232b26d58db59
- MD5 e658fb691ef74518ebd334c781f6cf82
- SHA1 2020104d45f91a01076aef9633e671134e5db57f
- SHA512 5a5011cf50b9a1ea346549c80cdcde5aba0e52ce326359d22ecf74ec9fa9494c289f477e902aaf87325ec469076c15964a4e1004d8335e4d3c6127baa7ed282e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1e3130773991f0144344c004f56f421e2a386470f6c678bf8bc82cda9c649bfe
- MD5 ab042d849b805ba22ca83554d4fdc4ac
- SHA1 765cbc8e7edc911c9d16da809536fcfe87f0e41e
- SHA512 5533f6e3a64c707622c8ce34e738d500d9416c055d88da39709ca52407c4faa899e92fae1623485722042c09e55e8fad29dbc3e468b906ce5dc56b1a690f50e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7ca02803e2ee540369c992ad9b7cedadbddc88e50b12c1c2949e9deaf433b6af
- MD5 4bd3b72d143268f15fba7db44e351954
- SHA1 c1bd51058280501908ec12c243cca37fdbcb633a
- SHA512 502d24529d412598af085d00a660aad1dcf502027490a8a2f337042efb3097c0197cc8f2cb4772cff702215109898890f4e306b1fad61f4ea189c56fc222d0bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c2e39b1527bcef6b2fd9176771e76d4730faff437c50a2628a0cc27755938219
- MD5 344a1ad30b1d6ef07ac71284d138bb9d
- SHA1 9e562abfa986e84e041f900daee88502294d5cbf
- SHA512 ed13512db60dac53337376981d4959f2530e8844ce96937b5cb77e0b74917b0ecbf66cecc2326ce988da0569aa74d0ffd93bf36d5338773178034df00c128fed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b84a53baafdca15afd0770e49d1ae64cd7fe2021b86bafb3fe93ac49e6d1efae
- MD5 b3c9827566d4a99d9047d3c0ff87f2a7
- SHA1 5f22328b9f067904176f726caac19256f31bce79
- SHA512 c88d87fef2f3f8f5ed271438e7586d6c28014c810af3dbb8ab565077b608ee0cb53c8aca4e09faa22053c34c1b2a7c5e80aedae47c681efca4bf0ff5b74db6fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ac544667260abdf44b811f04a49aec4869655b77e3de44b0d4fb231acaacd20b
- MD5 81aae1cc735efb46ff7cd7311c3fdfc6
- SHA1 19c76eca3b5bec1c1eb2c0aad892bc3f12d08c05
- SHA512 00fe1ed5e9412fedb275537fbf38c0906e5051f91d4f815e59f398b8d2d95dddacb2d10fc59aa96f995a5ff518fffc1fad718bde4682f9bf28810a9bd9bbc510
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 499089ca240ec08a52e4d9bb52ec455fb12cf311f57ba3a850fa0fe7b0c77893
- MD5 57616e1dcddfa365b91277a2f8bb9944
- SHA1 be395c834f78ed8b1db705de3505a3a2d3fb15e0
- SHA512 03c39411a6015af145c7ba67450bc77dead42d2839780e4af6ff77f7ddbd9ae455868566e250a848559b152aeaa51f6e02ad645aff6915598cd1d94a7307046b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 dd8b5fbf54d5df082d4053c8de911ee1bcb9e519a94a9daf411af2b1c8d793b8
- MD5 fe2299944c8a21229e81dd9bc20b6f63
- SHA1 5d4fcef0d884faa2baf7f7f676d55db91c8dc1de
- SHA512 0037e50acbbf7004c6139bbe30dd4b0b313bd4df929858d263255d7339b9e885bca967b9f37a5142f92c641ce65a810822e18d78fd545b083c3221b5478d5202
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e86cbe5a9e54feee34ec0d487e326983b35649d41f81622d0c51ebdf49a5365c
- MD5 581042cc6971ee59f3214fa069ad36e0
- SHA1 9d60edf06cd071817d38bc32808657d9e3f1b291
- SHA512 585bfeaa8b46b90171e17f3b9c8d83cb96daf41e9a1bcfbfc020cd9b5c75e3249f0c7580fc110a612a0bb3d7cbb3888f701c79f6ba769cb2d20bb338ea0131d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cb277411da0c6727f8c2a19a34bc1f4d0431935fff97a7cf4ac70627690b941e
- MD5 503ec38f046e7f25e8ae703e464669e9
- SHA1 7075a13f06b7e7e45923692464dba06ecb8ca42a
- SHA512 3041ed4876fb33d58b09fa4eaf2d9412c4f9d45da95f54e13cd2b34b3ed823109e1a6b5f6858ee6ccf287d6706f4f89ce49017f1bb76085d11730afbe75c734b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 70956fc73ee0f89063e01c7264d0be009a66df3d3cf136b443b692e1227eb328
- MD5 3fd25cd5dd8b447a89e38b219e25430b
- SHA1 ef5f2318a9328315a09f6f15fee78a7c062ba646
- SHA512 07977a4f0cce29e3a35cceeb7b5e258c56386c08ff3075b1a27d0258c8a222831907f37e99a54ab009e5fe32b70e62ae57c3b93a5a60897cd91ea416b6a5fc2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ea8aa83058efeb5669c976f351728fbb644411bdac212a88dfe25e12baa01928
- MD5 592195e28dcf2ee1f53cf20d78aa9327
- SHA1 8a1271e2a48a95d7f9a2b23152edc33787563339
- SHA512 f9abd1e67b9129cee50d0b4ec18d52d60f9f55c15559a0aa2a19369cfb3baf92db535234cb03faa7a3b6aafbe3dd64d252c0a929675e43bad4f26b4ab849073a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e92ce2fe64ee56781d4b1bce94fcf11d3d0577edcafd346640e993dc915f5f22
- MD5 5f9e911f93727d8f91f52c5f6b89164c
- SHA1 a3e070026be17135d8f04424ceb3b9dc2dd13e92
- SHA512 1e3c1b3f5be4a0f06fa148d82b78b4010228f7ddf623692993133481455d8c2c08fd7a66b2031cf407c0d319c8990e3df144eca2230c369737dfb127f391a4aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 6b8e86428c33320d855a4a594af07ce67220c348668804ff5e95d332e437e344
- MD5 44dbde31e3db676330b215d50b22b434
- SHA1 37e149a9e337648f53f19788c55af5cdba57122b
- SHA512 80b3aea75cebfe9f4b9ed8f1d8ca195afa3881c975e8376a6e67352e342e9c35f56ca29dd13302748c12f2c96dccdc30f2e8df6139cb7e8b8cf7b1654ae76dc4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab2685.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2785.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP