86bfeefce2acee5d39d7bb93461eb5f93a81658579ceb4c8346bb77977f15ef2

Analysis

max time kernel
111s
max time network
171s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-03-2023 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

publish/share/icons/Adwaita/scalable/categories/emoji-nature-symbolic.xml
Size

4KB
MD5

3b4101d29834e754cbbecb45cc0bb1d6
SHA1

8132e01c2fab9dd24242abbee05fc7cbb1e72935
SHA256

0541d5c072534709da7546215f11b060a349cbfef983f2b29bdec8ae46757d0a
SHA512

92f0bfb33400f215de4d1c257fdbff91cf78fcd2e7ca817c9b97139c1f59e8c1b3ae2ce798e21e4c2da1f622f0448bbe498898da171a9129dac5589c798e0c32
SSDEEP

96:BkU0reOmaDBHxbyVSgu0vBalXXCzpWNvQamsWXj:BkY3alHxbyVJu0vBoXycQamsWXj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1C68AF1-BBB0-11ED-993B-6E0AA2656971} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0888697bd4fd901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384825312"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000f7a6f555eb9fd9acc3d98492636716e6b0346cf81e3103a00bb17a2ed9bbefe4000000000e80000000020000200000003882c8932ca61f024cc07c15fca5cf8cd081e5a1997abfe02e647924fa0ab25e20000000ffbeabdd8207bc2b2f81692a0f2c48d7bc73b7fc1dccfe6b9654bd7c88847b4940000000fce0c90df6afe9e36bbd1beb55aa20063205b771be12adbdc01afbfde7ebd5b6c75ce4651c654563de2de16aa761ab44407f31eb61ed35a1887e4040724e620d	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000a3d3ccbda49dc3a94c6d56a9efcb400f385063e896f17aafd2748453265c44dc000000000e80000000020000200000001e598f97232692d88ec8b4c60109a47565444461b633a3bb2a999d3845f3170090000000f6dbf7fd8ecb21601e502159c173022c50c93bf781c77b10eb98e629ece314b18d43574df7f171cfded3b4213cf4ba3954b8cf439621721b7ad2790a5d7a22f0bd41d6a096d364d21e57a49730c52bdfdd3996c5f22c03dd1e7e8b2425ecbeceeede5b1526ee9509c8ed6c12a4813f24cf6cc329d35bdf44baa3dc13f30ffedd4b20c97f72d8b648897168b7bdf740bc4000000085df5286f2ae1ef878dd90514261773a7c035ab99ac5053deefffa196d3d3b1bef9c90a1f431ff8b764eb3192a4ca7882b7e43b7b5f6ce4a319adddacda9167d	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

268 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

268 IEXPLORE.EXE
268 IEXPLORE.EXE
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE

pid	process
268	IEXPLORE.EXE

pid	process
268	IEXPLORE.EXE
268	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1944 wrote to memory of 1328	1944	MSOXMLED.EXE	iexplore.exe
PID 1944 wrote to memory of 1328	1944	MSOXMLED.EXE	iexplore.exe
PID 1944 wrote to memory of 1328	1944	MSOXMLED.EXE	iexplore.exe
PID 1944 wrote to memory of 1328	1944	MSOXMLED.EXE	iexplore.exe
PID 1328 wrote to memory of 268	1328	iexplore.exe	IEXPLORE.EXE
PID 1328 wrote to memory of 268	1328	iexplore.exe	IEXPLORE.EXE
PID 1328 wrote to memory of 268	1328	iexplore.exe	IEXPLORE.EXE
PID 1328 wrote to memory of 268	1328	iexplore.exe	IEXPLORE.EXE
PID 268 wrote to memory of 1332	268	IEXPLORE.EXE	IEXPLORE.EXE
PID 268 wrote to memory of 1332	268	IEXPLORE.EXE	IEXPLORE.EXE
PID 268 wrote to memory of 1332	268	IEXPLORE.EXE	IEXPLORE.EXE
PID 268 wrote to memory of 1332	268	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\publish\share\icons\Adwaita\scalable\categories\emoji-nature-symbolic.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
98cbf2ca4e2894ee2e93eb6d8fc8de6f

SHA1
31f8ef84f528199ca4046467a05d0d45bd6ea2fb

SHA256
fa6745cf897e1ce4c4d10436efd10ac7f064443e85ddcaa5a7a376fabda47bef

SHA512
3593b15accd6dec284cadd2b8a9a98d3e03335878aa0b084dbed829b3ab632cf2817d6f7e615b127535e0d846e227b6d35c693ad5b005cfa09c3a1f43768b3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
13a32041336761d2ec8f1045f8d94774

SHA1
dafc1f0a17cd3e62bffe4a1d0caad70b3bdd1325

SHA256
c58e3eb0a895ebad98d16684f2d654f1eba2d928029effda5ce657b922acaf05

SHA512
12233af780cebc3e0ad0b429d2dec973c3d2e828d31a82567ee44a55ed6987c440d6ce1010538bfb89f427702762f9ceb843dedeadbb8f94d99c6cb0b6ee4747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
72094011490a6305558f00874af38b81

SHA1
a71bf5ece1352daff6679f09debc33e503ac11c7

SHA256
b778aaf28bffc1699c59052a04f2938b5d26836d2cdcce04a08567bdc9fa9e7b

SHA512
9a57879ae0eb8ae078590a1b610a7006fa0e0ab6634f7f6434d2bb108e010b70dea042fd627511ccabbc21d18ffa01ce70815c7d68c008b1141f5c1e504e5fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
72094011490a6305558f00874af38b81

SHA1
a71bf5ece1352daff6679f09debc33e503ac11c7

SHA256
b778aaf28bffc1699c59052a04f2938b5d26836d2cdcce04a08567bdc9fa9e7b

SHA512
9a57879ae0eb8ae078590a1b610a7006fa0e0ab6634f7f6434d2bb108e010b70dea042fd627511ccabbc21d18ffa01ce70815c7d68c008b1141f5c1e504e5fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a727c8da7b101d77124fe5ed96442cad

SHA1
27fb28033cea975b17d2d8a3841e320f2d8d297b

SHA256
4e74f8858daa4b13169e53ccdd6d166d10b1ab40f871070e5c6c22004405b895

SHA512
238db977d64b3957fbced0b850092493b0caae2f6e9cc9c20104578c2a06cc693122b016b9ad39ac7dcf7a492391f11cd9e1f9479e5ef33106579681f31abc7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fbb0a1ad80a3381431bd0652526b7dd6

SHA1
338827570b0e306d68358b525e5c1b398c253509

SHA256
3f1924ae0e96228ad81e2a14620a5b36c3c5f975271062d96d9c3a898dae7b4c

SHA512
ad86cd5770aaec8edb4f00568100faf9ed95a734346f1f0c54460d33bf24b3b3acc5ac461257304b3804cab26b8b658236f3e7747e98251162bc650fc67e493a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0b75689aca3463429146a4d023468822

SHA1
29266d8fe535b924dcd715391861a78d91380e6a

SHA256
6a8fc69be7cdc73ac98cbbd6e4102b6a2cf935f810a5676dda7445ff9344b533

SHA512
9bf45b8a23d28c00c56ec676b43147730f896864d73fc0706e422fc3c08b5246e3497ee5daa5225c29bf7ec85e9f744611461ccb1f913f8e9609abf8afae421e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7c78df90e0c1677f574c6d8f1cc8b4d5

SHA1
dd894c43af1e831691f2e712fae3cd39b6526c9b

SHA256
a8ff526c98d581f95e84b2f3c00953713e85f786d892d0eb08cfb8a370fc67de

SHA512
8180e48be2a5004e48b37f6feaebb3753f9be759d23b8fc13f3a10c8e80091b8a4874b26f77d23477649c3c1fddc52a2e72cf047d0b7657c167f1b44414e0764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b6458b2af620bd3750aa5dad742e9365

SHA1
5e5c2c3967a18317e52d8db4d30a47d49d643cf2

SHA256
8f31ea6f4822d7b78f35002a0d423dea5dc7cb40b5e6a320f962fe6bc2f5e9b6

SHA512
b0b764012a0ed37410a6642c68e71b07db6e4557dfd9fd3c647bc3f05ce9133d8c47c3417c559ae756dd9f04e9216b20e5be582ab74f553c308d105f5ca17621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5D8.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD669.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6EC.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0L3QVPIN.txt
Filesize
608B

MD5
fe95b12115af72b5bc01b5915fb4f9c1

SHA1
06929dbe8000801af561163916bba36c5f773384

SHA256
73b813813f13d6c46d730378d7bb4e7d02415a30470c092542731e6cebd7129e

SHA512
41789e3c2c299256b74d94fc941f59c63a3fb43fa26803c9367dd1980e5348479aa2e9491af4353800b734b7347887e0719ea008cc967e3f7857c87deafc119a

Download Submit
memory/268-54-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1332-55-0x0000000002470000-0x0000000002472000-memory.dmp

Filesize
8KB

Download