3b202fe7631903ca7dce2c4c58b1ca5b2445af9e4bd7a5a2e65de20da48e05c0

Analysis

max time kernel
128s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Office Tool Plus.exe
Size

4.4MB
MD5

9cf2d306b7c36774c2bd88697015dd11
SHA1

b02d8b7665c87fd0892db621812eecaf4d3b9d2f
SHA256

3b202fe7631903ca7dce2c4c58b1ca5b2445af9e4bd7a5a2e65de20da48e05c0
SHA512

227e54de2e1da5185461d82524acf3c1df4623032e323e1c499d3db720e1e1b5a27a3c1ddce7ca7118c0a1d85acb369ace8f491a6ca5ef510632a73b341224cd
SSDEEP

49152:3Xb+SD18VMNODw600948jQkfZUi58oVKv4F6bXhv:b+c18VMiwAhjN1Go67

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f5930ffe21b7842a1750915908260bd00000000020000000000106600000001000020000000da3c933a119390de2b87eeabc6008d87d3f2ff5ba005e8e91e04df8bd445ab64000000000e800000000200002000000007b3ad1d8ee9cdc3ceb8d624710e2014b18f1318023f13076b7209f780d04f622000000000d199e7e266dd58ee8d947cb354b458cb410ab1a3dc74bbeda70ff7576972e2400000006e4104eed22fa77133de4ac0aa61cbd1cbcf930957829708b3feab1c8ec6c8a57577df8180f586de0f7db74dd6770728607ed9ce4b9ba600301597a45264f99c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "124"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380221047"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "124"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EAB9741-91D0-11ED-B390-DA7E66F9F45D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408e3b6ddd25d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f5930ffe21b7842a1750915908260bd000000000200000000001066000000010000200000000571dd235a632eb66667524802fab94b00bc70ca3320c5efe4338fb3a0d21ee7000000000e80000000020000200000008effe77bef44b4f237e3dc2b82f2554ff0c55675bdbc1f73d1bdea3e3040470b900000005d3d9f94f931b5ee14326e9c6bc2ec7ad7ada30ca6b0cac26cf1252017ea79f060f448fa9775ffc6e823a73e060945cb09ba782ba09b871f0feaa12dabbb15d37cdd6b85bb9c225981cbfdb614ba94307d742a1b0b84ba03e8ea9c12da503e965c87aab6189d5a81713a674223905e322ecd079b95bb61a97d70ff6ae0e1b786f78b245e6022ffbd3c40bff23246ea0e40000000cd638af57f26800e79ae202604ace36d1697508c2ff3834358f7015c4cc54a699ad62aa0c5c410b579931664168ae8d7e470b5d16205c03f1dc1ef4681d33445	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1488	iexplore.exe
1488	iexplore.exe
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1488	108	Office Tool Plus.exe	27
PID 108 wrote to memory of 1488	108	Office Tool Plus.exe	27
PID 108 wrote to memory of 1488	108	Office Tool Plus.exe	27
PID 108 wrote to memory of 1488	108	Office Tool Plus.exe	27
PID 1488 wrote to memory of 1140	1488	iexplore.exe	29
PID 1488 wrote to memory of 1140	1488	iexplore.exe	29
PID 1488 wrote to memory of 1140	1488	iexplore.exe	29
PID 1488 wrote to memory of 1140	1488	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\Office Tool Plus.exe
"C:\Users\Admin\AppData\Local\Temp\Office Tool Plus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win7-x86&apphost_version=6.0.12&gui=true
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
629c67a7ba20c01aafc5c53fcd545d99

SHA1
3f69f62d2ecd0f9dd4e908bac3626dde68c613af

SHA256
fbb7373ed909b784b73b940b477dcdc741d2aacdfa4cb3b9e32c08ee4ed3fd63

SHA512
e9441067d9672364bb1481345ef1c711c44dfe8df750a081880d9f853a3b47ace2248b2cd46ff3d617c2dceaf6647d3ac0721808d14090e399801919b3c8e1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9572bda1e5a4f8d541b59ceb25aa90f0

SHA1
bc1560bf0d23db13d0cbba127a3c4e89f713218b

SHA256
55c89cea7ae9e69cb77e955079834ad975ac0ab30400eea89bf463454ab02af0

SHA512
4394b13e38422ec2fc9d7296dc29e90b5bff6513c4c46d4956180b0cd648f5aeb29156815684b0d77ca140b00fd9c84d79ec0738c63e24b203e0ddc9c57a4dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
21KB

MD5
a3504be06f103edbfd4757712946d73b

SHA1
311f00db8ec591daea05b5bcde410925c2fa1eca

SHA256
f3ca6dcf6544034099b5466090752fc9615f43b74f1f3c227fccba19606edb6b

SHA512
83698c72050a1d6516071f6b5b53ede36b581a5f31cda25c425da304cfbdadf8837cdcdee6930cff868e25dae4439cfe27bdfd8ba8c00fe7b007077f5b9e3780

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CWMYGBXE.txt

Filesize
608B

MD5
5fd5542397c7f683af8af9c5ad139c3b

SHA1
b00ea4262f6a508ff1de1db309a33c7a77e660ab

SHA256
244f036b5b95802964c78cfdd3e23ed0a5887a4a98c4f47db3de53f9d71f1752

SHA512
ab73c9f8660e8053154b39cfe8c93b696f8e8d5b8bb2478eb0193ece244a0c86e21f0ea63ccb4d1643ec861cf251c2850512f0c329822717cee1bdc1ff426352

Download Submit
memory/108-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download