4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
100s
max time network
139s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ICSharpCode.AvalonEdit.xml
Size

582KB
MD5

5bd494ea6ab9ed3a0dd5f4736a6c1f8d
SHA1

9ffb4fa061171eeba0714cad028c4655aa2d241c
SHA256

a8de4e43ec6747781a7e01a7e5d51c92cffff32879e6bc3795c75c9ac90fd9cf
SHA512

60eb5a1a8b253e680bfe4340c2ef4810ef3089124959804436a1a910a8750208972623923e7613a03a41db0d08a93c568c7b424a5406bb5ea40453f2c617a71c
SSDEEP

6144:sFilxsTCj3BkjMG8AitANoPNzLINIFlhgTS9ycdxyhxYYbqEt:9g2Yc4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e20000000002000000000010660000000100002000000095ced78d15a001b63b7b2cf7466e43b11a14d4bddd25ec3b5184a20b483094ce000000000e800000000200002000000038a91ee24322c8146491c51b649e548304b6db6ffe6c390b3279ebf9ad9c5efc20000000f08999159beef67b9ab8bcb4796e938f10ecbfefa7e8e5a8563bc53384b8d06a40000000adfb98b1bc8d655534540010984529ee3d0963cec5e16a6480e528feb59a7a6166fcadd8de2f96c21a2af5b0ebedea03d9f96c7a0af42cb2e762d3efcb2e0699	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206abee3ae5dd901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B9115C1-C9A2-11ED-810E-724BB54F6CA2} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000005a734293f735dc4da328e6e13b50a17237f8bb945c77df2993fe96a62a3ac0c5000000000e80000000020000200000008e7e89239114625d2617d7ed4840a1a2cc24b3485557e2eda10bbf6b8f82000590000000146232a595b080e5aca5ebaa783bbf83d30c356a71bbaedd23cb9d169f4253ab2c3f855a753811e84eb2cef9461e92fd3232ef0d9d553af2458cefcc2cab0c398b4f335fb6b01e3a94dcb06e8ad0d783cb579cd95c527d00cc32d9f472427b5c601a27494d8ec3522b18d08ba5f2d2b72a2d9958da1eb021cde1cba5c87fc3decba41e363d068c67492ff4de2f936b1040000000502d44fb31c2cd774fa63fedf3ec27790ac3f69d38350ed5f593588376ab44501d8de8b9828704c28e455919d3be26c34f5f14141842467da1eecf8ac67b0210	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386358309"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1496 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1496 IEXPLORE.EXE
1496 IEXPLORE.EXE
1652 IEXPLORE.EXE
1652 IEXPLORE.EXE
1652 IEXPLORE.EXE
1652 IEXPLORE.EXE

pid	process
1496	IEXPLORE.EXE

pid	process
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1572 wrote to memory of 1080	1572	MSOXMLED.EXE	iexplore.exe
PID 1572 wrote to memory of 1080	1572	MSOXMLED.EXE	iexplore.exe
PID 1572 wrote to memory of 1080	1572	MSOXMLED.EXE	iexplore.exe
PID 1572 wrote to memory of 1080	1572	MSOXMLED.EXE	iexplore.exe
PID 1080 wrote to memory of 1496	1080	iexplore.exe	IEXPLORE.EXE
PID 1080 wrote to memory of 1496	1080	iexplore.exe	IEXPLORE.EXE
PID 1080 wrote to memory of 1496	1080	iexplore.exe	IEXPLORE.EXE
PID 1080 wrote to memory of 1496	1080	iexplore.exe	IEXPLORE.EXE
PID 1496 wrote to memory of 1652	1496	IEXPLORE.EXE	IEXPLORE.EXE
PID 1496 wrote to memory of 1652	1496	IEXPLORE.EXE	IEXPLORE.EXE
PID 1496 wrote to memory of 1652	1496	IEXPLORE.EXE	IEXPLORE.EXE
PID 1496 wrote to memory of 1652	1496	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ICSharpCode.AvalonEdit.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67dc65205261e74053018db4aec8e155

SHA1
3116be1e20f3de983f05b60f506585b3251b69cb

SHA256
27ce495272ae7ecbbbe79a1a8c87151dea6f5913bda094d268d4329a66bc49d5

SHA512
59081e76819f89eaaeab5346f243d3b604e9fafac24c037a34096734a0d080f95965de1f7526071bd72cd778439946ec7e56da77ac05ff5308b6e69f550cf124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77dc5d14ec6ecb27241715567363a0dc

SHA1
f9b275c50888dd62b6877bfa4a62e5312ecd4965

SHA256
4cae2374c6f054d7a599bc235d917ab218860b68f083187e98c16baef2127419

SHA512
e8b4496effcda9e69dd0beff4006652b5fe77781f900aaebfd7bc72389cf376f9e2528806cecb68c85afd459219c425e43f9fe0be8e0d4ab1ddce1ef43749102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986f21654de6cbf6a342f703b04f75d5

SHA1
31fe70de4d4b9b5a6af4e596630507ccc91b3197

SHA256
560d28e8fd34494db4ba36904ae4d06cb8e2638f07dd88c31ad6e4490e1c8371

SHA512
db5de37317061c0056d7a73d9e220e9d9a9366708d0aa649030fb961909a13380a89a3fc9e94b44f9b0df17a0378b87919f6e2ac4a8d35d19a6998e57d5e674e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4d4ef2027bf8422b2fbb9dab8a536bb

SHA1
048c86cc6d83b814265831ce6c97e021a70de627

SHA256
b20c1c359490baa0f2cc2f020d6c6dd30f3e60bbf3b14b0496ebbacfd93bb2a8

SHA512
d60afa1fe9e57357e304b7c5c0c1e77290844162218eaf7da69a198f6a1693ac72244e9888eee2c58097083ef377febe5477af92536221d40994385cce7bc2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8913d8b74b06c0649e3740e1505165

SHA1
cf3fc30ddc9c9ed03839f939088ab221dd7f9cca

SHA256
06cac376b865a5c1e600a0e5a58452066c72683a61911a186eadc6dfaf0dc7ff

SHA512
e8ced9f64063c3a8b67e21aaf91eabaa56c2716ce66b217d8f6184c8bf1d7efed6e0bea19c016f86279aff9067cd4b907cea9033104719235508e76b3031a0d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e82be1881a11817a57474dab5df6b54

SHA1
ead085522c1599aa2ab65302bb4c4f27160b94b9

SHA256
59b46c32e45a91dcd1a5f0597f062a7256eb7a3d0a6f125c40fe119fa30afce3

SHA512
efab5464a8f46e422856607307bbfbfd574416e1ee4ca1bc2e7bfd13653964ac16c2adb998cb44f3b35b16ecffe148a1ecdc458cc728a383bcaac25da2686996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af99986a55a76bd7484bac659c97aadf

SHA1
1a43d31e94b79706220568dbb89b5754422011d8

SHA256
953535777c3d3dad51a3e688dfbe87df2044dbd13a922907b44016b937c00fb2

SHA512
75f08d911343784a1b1550a2e6cead1b98894fd5254ce7d7345d39ea0da237a26d8e0b70c726d7df0c454a52b5e018b7b5cd666dd4aef5d02f75b054d96889fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be6816b4c7896dcb97b45fa4c8e405e7

SHA1
569b81ed9e9b4edbc06e5b08047599e19ecd896f

SHA256
6b028a1a9b0e774b09f1d65bd8518dc96a14f939c2f4fe01a8b3538c8d743b1b

SHA512
aa0035e172036f54eb1ca92a0dbd5c50cf39d6b11ccf19b7c4951c79ff613def968031e49f754374a877649657db15204c0b7cc51aec7a6bec6848e41d79d504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0dd3609a2a9ce84b2b195531a6a4672

SHA1
967ad8739665b3b038661a6adad2919efd295bd0

SHA256
bb6f095093cea99344686cb268b91d556188ebdef980c0fcaad8268e620e96c3

SHA512
f1f7695613b70885caafc09d6c698780bdfb9631bc06582d08dd5b431a95eaf3e917ad49beead0cb18f3c5761bf23b132b917f837b2e91c73dbe14aab88b6a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KTB503AZ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AF9.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C33.tmp

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CF3.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S754E9Y9.txt

Filesize
605B

MD5
a3e5312fc815d8e103829a81c7738964

SHA1
4b15e86157320c7f33a89a2166bbce0e285da4a5

SHA256
d9e75093134bcfe695bd7643fc5f0d0464beeb6b27ab2f4511c0cd662004c7cb

SHA512
12f2628cd2bc09e4c076b94381d46239a365200762615e5d442ccfd99d5785aad1131fdde05cb5b740ce105e8e6ab1682da77e34da0791fbbc8a3c042130e334

Download Submit