Analysis
- max time kernel
120s - max time network
149s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 23:24
Behavioral task
behavioral1
Sample
dbf2imc.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbf2imc.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
icons/navico.url
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
icons/navico.url
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
old2new.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
old2new.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target icons/navico.url
- Size 90B
- Sample240613-3dzzbsyerr
- SHA256 a8b063e84834095375c81ca72320005310ac75bf479da4a5a38cb8c91f6026b7
- MD5 95173c7e19b8c95e77bd727acf7fdcaf
- SHA1 e0ddc7df96cb2dd98e5fa90a201273a5b0d8f20b
- SHA512 31067e15a7a4cbb53de0b4d63b9b64c6746454c51a29ad1e80a30627d23dc25635d964e9ab1749f86a1ffe70770d8c0bd5076f358cbde3106750718f991fbefd
- MD5 SHA1 SHA512
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424482966" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007683eb837c53a444f1c8ef554652a74d08c5e61213c71ac67ee3662cebf82f6f000000000e80000000020000200000000da21610820aa0fc03f56b6372009ea42230a95f14cadf78b02089d8ffb2cf8d2000000037dd742152923fb7a0bdcfeb934372cb03eab3e6b80fea5d62b9b7f7b0321b2c40000000f2a48b4e1dddc436403118871d90f06100f0ff52249aed6b03bbd6552871900b85cf1457308b3d52837897dba4daa727b9cbf5c004c4748b6c4c3dbf008fe602 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6091aff4e8bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C8F3D21-29DC-11EF-AF9B-7E1039193522} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000051a0f7c0511c1c32c9bdbcccdd4bba5b82498908e58b15e767b7d2ecb270a97c000000000e800000000200002000000069a6a16111d598332498f0fca58ec1f77adfbdb7f0dccb7aafeb705bde96860b90000000db2f0d74857050872e960de848886e05e50ef1925089ee0f90ecd5cf25a82bc9cd341ea1aed06a12705a154e7175571bb8f71f586e7524b944a94baca5747a484ab8cd9a829cfb1ca1c5876843106c6706426f3a85bf73dd570f3a423d2a05e614c9dcf81305f43b090cc378a6831608ccd472623680caf7b2d7d9d47c8ecd2c47020335067be3cd53e4f9b67d50926840000000226e7f2d89ed83f20d440c23f02c41a64ab6fad40b47604ea196dade81ea1b7279b569ceeef9647bfc763363c7be65c0f6ed917965970601abb333825fbccc5f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2524 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2524 iexplore.exe 2524 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 3036 2524 iexplore.exe 29 PID 2524 wrote to memory of 3036 2524 iexplore.exe 29 PID 2524 wrote to memory of 3036 2524 iexplore.exe 29 PID 2524 wrote to memory of 3036 2524 iexplore.exe 29
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\icons\navico.url1⤵
- Checks whether UAC is enabled
PID:2012
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ec5d610dfaa8e3e04ef05086286ebd5218c63b9701b6f57b42279ebc7e786c63
- MD5 3e63e17bb76ce31d69c4570d8867ebe2
- SHA1 49d1a8f44f5e0d21aeeb6f0379c53bcc8b9e5167
- SHA512 267f5031058e5113c5b512caa3d1f7f9c8c68d408d8ad960705d017d67c8a4da7384b7d9c8db2449adc8bcfa201b53aa82fab28e7841b2562639d5346b4b88db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 10088b472eb454a59331c9c7409ca0731d70b5d728e12b5c965b66329159bb8f
- MD5 bc31260ccdfd74db3e5820fe19691af4
- SHA1 aeb18717a66605036db6cf6996c1902527eba58d
- SHA512 bd9f0a2f097529517136de8680d01495707e6b5c845acb48183b7307290791d550c2b2c67d9a108c5a848f4cc254049815d5a32738d58662ce73e0520142cd7f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3928dd95d8f54a358b82036b4665d04936892b4888ed91dd2049029d6dfada9b
- MD5 02d4047482534f435c7027b5658b0ae7
- SHA1 adfa61f015db0fd8d70ca53f8df08e0689576e96
- SHA512 e33fa401babdc5863bd06b33f4b2b4ba83b38ea1417d22d0661185eda67507772217ecdf4edc94550528b653ffeedbb92463096372f4b40b1bc3572ab14f4fb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9e1fe604ec59895532703eeb265a0578cc76300fb4771c7888b86cf093db33b1
- MD5 89d1871f837b900b89d06cabbdaefe95
- SHA1 6e0f169891c4656e44808014be1945b343dd0e6e
- SHA512 e6d8e3cd980113dbbb894c45a3f6b52a971499164c2c8dc42054d533d597c748e65d88d7290a6deeb6d2c49bfcaed77631396dbf489cccb4671ea9ba67b8c6cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cdaf9c1b960e01c62a98a24c8cd951c0a3e31b07b4196e9a080831581093fd87
- MD5 cc90f5c091067cbe5a07c634527df9b6
- SHA1 25a3fd261a88fa3b82bf109d6d06c4595c5779cf
- SHA512 e3467b40b6bf21a4ab305004948b8155300efd3663ce97d52c3adc1f679679951d7477763ac8590527b23b8413fe7b914aa51a76fbbe11f655e9c32df9629abb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 043abfcf316a4fe1a3ac130d77c3386e10d309a4747b1c0b586f7100831652c0
- MD5 47c50bb9c17f1a672949b263178fe205
- SHA1 b1c435b2f621cfec0f48652728447a1dee3d675b
- SHA512 73ea40cb96542a8b64fd3cb4bf95eb07e3d9ca3650d800a923098a2b6b898be872ee4c457581e8b4dc05ae681db08f1015295b5162e301f6aebb8af88498a200
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 dbf375bd317ce9146271e156543aa1ea52f4ed80b475ab845c1ff74d845f3ffd
- MD5 374c758686eaf8cb17f6b14988b9d849
- SHA1 2f69e65072e77c6876be0c20ebac1652a8604f3c
- SHA512 90c28e306f72925686d9e71831a3b183f838788560d990f6265dccb6382e2066abca13ec95b7cade26f0ba8e53d4860dee21033071be7d1a68c8d4549c7e2518
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3a861401531d450289862d291bfdaaa7fcdcb0dba9998c097efb6636944bf307
- MD5 101158c3a9159cf62234af522e62382b
- SHA1 52b5d02a3be82533cf6a284ce9f04ac21ebd7979
- SHA512 c60aa3e40c4106c3c885dba049c4a236042321507ebd54d9aea244df4cc0b3111deeec0f083735384be2e118758489ca2bca98069fec033601149d415b2233d7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 448358a254bff6e72882de1bc66b62b9881a2b29f020beabc80e8877a7562067
- MD5 060f459c5f3c4cc6a2fe5b1c5910a6bb
- SHA1 22010d6f8fcce473ce910921838fb95dc557cde2
- SHA512 4592f4919fc5e2f1e64b3b0b80a0b1fb946e3fd0dbb2e0d5dbee877314b57e753769a29f00d5b08fab3f2630bfb9356b797307340fd8303ec14a93d0d0ac487e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 212effb1eaf118caec665eb2dd7a3f87411ea0911087287247875e0bbd12be6b
- MD5 3b6fb48bf4beaa7bdb6462152c8cae7e
- SHA1 b02af34c9c4b681f7ce1ac05d10e08a46bb8c550
- SHA512 c26f3124449128bbdacc814edde2cdc357a522e9bba76bc9ae6a69f43afe38903150c972cb87958b00c457e1f4d62e868832c7c008b4be2afcee15d470dd26ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab60F6.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar6186.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP