430a41870f43b13de68e01b3c37ae2f8eb22e099339cb6ebdc3fdf5433543334

Resubmissions

26/09/2022, 19:00

220926-xnpnfsbgd8 1

26/09/2022, 16:07

220926-tkzsgacdhq 1

26/09/2022, 15:41

220926-s44ebsbca5 1

26/09/2022, 15:29

220926-sw34lacdbp 1

Analysis

max time kernel
111s
max time network
136s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26/09/2022, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Users/kmlarsen/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/W4YE5R4Y/☎️ Voicemail Audio Transcription.htm
Size

13KB
MD5

743bce526b069f0c70069210fbf399b1
SHA1

884b1d100def065ba2964f81bcea919a44a3a2f1
SHA256

2dbd2d653764003082326aacc9b1267075039f95446517cf6560a74785828e16
SHA512

e0b79bc1cb7be72282ce7373957c1af7f3e2333efe60b055a0acbb3fd6563da7c39e1a0520597797f99d7f28b898e19f2957103a67cc954c549964fac24c26eb
SSDEEP

384:KbcrRYCh//If1GdYxNAPoIIklxYq/KxnppHltlfKRLWcwgWwaThTZbKob7/:KbcrR95Qf1EYxNAAIzlxYGKxnppHltlj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09e6e3dc2d1d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63746221-3DB5-11ED-A5BF-5242C1400D5F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370973454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000aa97e657d67ab9595eea53e6f43c121f52ffcf764bf2e1ae4d5a2706c4841eda000000000e8000000002000020000000e9a062660cff041a5a1e155706f6366fd20cd9e828a5d72edda0ad9eec8e712b9000000017b62f5d0e9914f3662f41bbe81db3be9ebf2ffc42964377feeea0fdf0d4eadc72b26fe7ae24975f19ac36271a4dd162c04828a9a9b47fe52b12cfdb5b0834fc262fd82b1ce3c83d65cc1d2cc3f35b2d317052eae04179dd512b5ae9d0fb454761df6151fa0ce215d748b9a83b31fadb94ff51b5231e2d4335a3522256559fb7285422d4c2348f5549d0d489052dae9740000000807f466f85eee36945f54a3bc4f8bc3a723b906577cf539494d6716637b4fa370d052326b9c03489a1b633f432a9a7d4691812538406ae04b9ac11647b496b2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000795ba2992b052f6251e1b1a397f43a3641d3f058790fdde3b86dcdad1bb8ebeb000000000e80000000020000200000009fe4e49a769d9bf5b5521dc161ce41f4be2df79005772d8d21427279483bf25c2000000059bdfbfe407dd76cebc8a0924e83373925df5bb95a464639c898d88ae7f59d764000000019f45f278be3082cc0b8f261d3844a1abba1489f358db8319624d9576c210c9733cf67ddd44767695179300747c02c7d44331971dbb9a68704090642a5736530	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE
600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 600	1340	iexplore.exe	28
PID 1340 wrote to memory of 600	1340	iexplore.exe	28
PID 1340 wrote to memory of 600	1340	iexplore.exe	28
PID 1340 wrote to memory of 600	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Users\kmlarsen\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\W4YE5R4Y\☎️ Voicemail Audio Transcription.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b6a1c1d810f4fd9b4d3f8302d14846

SHA1
42aa7fa6eb009a0e198cdf6c5e995aa8dfc364c7

SHA256
7b2a69408025e4490b799d8c06aef761290ab2638b50d5d45d56e60079f25443

SHA512
f28e6c3ec5a36348f67cca62b6e2e4c434edbb191abc0c9fe3e453fc54e7cbd1d0a90c3548fab29b6862bf27dd1eb1cc18a18b8adaa35653b926c8fc7c2e8e8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9CBCIRMZ.txt

Filesize
608B

MD5
5a4c8c1e6b411539e66cae5713d2d785

SHA1
80d0c521cbf2f794f338bc2ccd835aca67d0b28c

SHA256
3375a21f892bdc747283e85bda23999f9d37527e72fbcb7a6fa8a06781539c0e

SHA512
06849e519bd2e8cf41f55560c257c5e859e1e4622af5cac0172f4c4384b91ad265826714295b321cff071a6861e5aedaff93980479b05ae01e702049c8c79233

Download Submit