Analysis
-
max time kernel
35s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:37
Static task
static1
Behavioral task
behavioral1
Sample
3dgifmaker63234.gif
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
3dgifmaker63234.gif
-
Size
267KB
-
MD5
bcbc07c653758f78320d848c316c4670
-
SHA1
5f71d39154823280999538171e66566a08bfe51f
-
SHA256
0efef610a555393bf5661164a7f8c184b9f162a4a71e3be0070fb5aa3cdc0f06
-
SHA512
095abf1540175a5807a65aeff4ea69ed09af5a595211724dce28d933f997fdf8a73dec9d1425997f20cbf5300038fffbeebeb10bf02537c8f5cf40fc051ec678
-
SSDEEP
6144:SI62dlleAYK6Oj6GZTEdTw0RMylnzyqcwrQC:Sh24KZZ5uRxxd
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31133805" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3099661b6d10db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039570b57fe416e4dbccca910bc3eabbd00000000020000000000106600000001000020000000ecea31f0dfb4c12d54b19ccc23eb921ce2f0c483adac2b78dcbc2d4260a01195000000000e80000000020000200000007a5fdde4c67b19194f6ca9faec05a5adbfe6a4164638459b54162c163279386e20000000dc106fea5f10ab20c060ce458fd8044fe5ce223911f18bd9f2111c6e8f83663e400000003e81c347c5d5949aec77819be498021d44b749f87cef49fb944c6f12cc876fdfa0a30229120035277dcfd30fed8613a2b5b14b3e91ae0dcfac1ec936a7bf5181 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "454554450" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{466EB3FD-7C60-11EF-98CC-D6586EC96307} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039570b57fe416e4dbccca910bc3eabbd00000000020000000000106600000001000020000000ceee32e674b063d787c1a4672f7c03b4870ffa7fb88439f52cb25eab0f9bbcf9000000000e80000000020000200000006d83a8034188f18e69a0a1c7c44ac0623d3bd34a3a508664e01d17bc9a27e959200000006a3dd42c2ed7e0ed3d220c2e4a020a96fe45c5376663ebd6c1ef498d5c368e0c40000000b98d68041a9fe60a6e59d56419464dc834cb976a9fed20dc59bb168e2178f022a3031a9f63c89a91b4d616b52a888bc7bada15d18880ca6b5aa1fd127354d8fc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100f701b6d10db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "449867040" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "449867040" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133805" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133805" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4800 taskmgr.exe Token: SeSystemProfilePrivilege 4800 taskmgr.exe Token: SeCreateGlobalPrivilege 4800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 1068 iexplore.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1068 iexplore.exe 1068 iexplore.exe 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1068 wrote to memory of 1660 1068 iexplore.exe 82 PID 1068 wrote to memory of 1660 1068 iexplore.exe 82 PID 1068 wrote to memory of 1660 1068 iexplore.exe 82
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dgifmaker63234.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD502f97850a7cbc788eaa63ca9980845e6
SHA1c7bc23d160f6603b590bb7d1ff5700d37add3be6
SHA256d48ed68a99ace2d38001d542f7c8b9594a6d7d6c95c35de6c9d0b888ca035916
SHA512c15716832f1a4c0f577bcaee0140d6fe542882e88adcf1c61566d25282b2d15f6bbe187d0361334aa05e494bac6fffc241d3a330d3c0a958464b7be75749608b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD587c03a91a4aff3ffc45476a2f0afda88
SHA16483276b6772aece77c9905d55e564fc8db59d99
SHA256b4ed5df0754d1a1984669f3e58c773d10e1e6bf2fee766d488580c3f81784a83
SHA5125b99737b88313a6d1351acdd6999799b6a90e08488c1c9ad8bc327b00a5f076b5f65c0fc7f13b7954d0276dedb874d280cdb4d2e9a5242d3f8025da0e3250ea3