Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v191014 -
submitted
14-02-2020 09:49
Static task
static1
Behavioral task
behavioral1
Sample
http://alevelchemistry.net/wp-content/s555x1100/*
Resource
win10v191014
windows10_x64
0 signatures
0 seconds
General
-
Target
http://alevelchemistry.net/wp-content/s555x1100/*
-
Sample
200214-mnms54e7ra
Score
6/10
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC9EBA92-4F17-11EA-BD7F-42BFF2011378} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies Winlogon 2 TTPs 1 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 5008 wrote to memory of 5056 5008 iexplore.exe IEXPLORE.EXE PID 5008 wrote to memory of 5056 5008 iexplore.exe IEXPLORE.EXE PID 5008 wrote to memory of 5056 5008 iexplore.exe IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXELogonUI.exepid process 5008 iexplore.exe 5008 iexplore.exe 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 5008 iexplore.exe 4444 LogonUI.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 5008 iexplore.exe -
Suspicious behavior: LoadsDriver 26649 IoCs
Processes:
pid process 648 4012 4216 4184 4180 4148 3988 4936 2624 2632 2328 2416 4976 4992 4944 4952 4932 4924 4892 4900 4912 4884 4640 4656 4648 4632 5052 3408 3360 444 540 788 816 728 1292 2376 308 4964 4960 3528 3548 3552 3656 3696 3844 3660 4492 4092 4080 4088 3556 3596 3192 2960 4100 4820 3416 3476 4660 4800 4880 4848 4416 4396
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://alevelchemistry.net/wp-content/s555x1100/*1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5008 CREDAT:82945 /prefetch:22⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ab1855 /state1:0x41c64e6d1⤵
- Modifies Winlogon
- Suspicious use of SetWindowsHookEx