908bf5bb5d8adc03eed3a19f64165ca1492d21800fc6e23a56a68117933be083

Analysis

max time kernel
104s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/04/2023, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Contents/section1.xml
Size

254KB
MD5

22384fd2f127f25b4a35ba762ff67fe2
SHA1

7c65ae802d4dab59983c1b3270d7ee629be72920
SHA256

7976519a947f8e7d511cc5d6b4df3067c7488d9c1e4f70f43b76e8486681ef0d
SHA512

162ba101a8d699ef69cf50294404f830a2fee8308dbf7905fd956cc2cf7a2ad6ebf1a9c8b34b3a1eabdec36c7cf8cc35c6fda62b0ee11a4b6c8510dd5159034d
SSDEEP

768:j6jOtB1RPCZ0vQmS63I+SQZCVffa6q+EIo5skTN69TGFzOTxNKO+qa1i/9NyO:j64CZu4ffGIotTNaTGFmqqa1i/9NyO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c062c2710366d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9229A461-D1F6-11ED-8884-4E1AE6AC1D45} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a4000000000200000000001066000000010000200000001558cdf5680e780ac5edad0e9bcbc90c99f94f46101fa2b6d86ed16546ad264e000000000e80000000020000200000003bf45db921866e8829d5bbfc025d60bf218d9967fa5025ce01a3872bac66c2e820000000a645c2b877182e24a1a257e46809d3f11eaacaf941760e5ffc67b6a101095d7440000000d11ef0986b18e6eaaa2e91cbe91d361650c5fa324199141579f11d42ab96eb0b33782939d169fbeac73e917a226c7ed617b575e69c52d336683d92c1d44f751f	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387274223"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a400000000020000000000106600000001000020000000ce7709e80a2162e472beca81abbbac38a8ad11e855483e8609f275327a4cc484000000000e80000000020000200000006092bdbf1c84d3f2c1970305e336a58f4dbf0948af0a7e456813a2929e1942269000000040afa726e069eb92baef427fd30ab07fb2805bff8c98d4a1d632d286c72d52b6d6577ee2156955df3ca1757f52d1fb3b646bff91c0d55a9b6634554538e6f51f1317bf6900e48abd6978c7b8e0f1429a9e7bf8282009bf19c7d5a4e19fb4b72e8fefcda7ab7f72101eb42dabe0f0ffff9c51a7750fb5dc6195872f14c7aa8b9a1520cd98fad29e22e0969ee1f7f72188400000003af544fe874323cd802d223de52db23bde84c734f342dd51c76dce1a72790479b2646433893bc15c2a40fd53007943a4e471f31960b454ca1935892c10c1d4b8	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1008	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 764	1376	MSOXMLED.EXE	28
PID 1376 wrote to memory of 764	1376	MSOXMLED.EXE	28
PID 1376 wrote to memory of 764	1376	MSOXMLED.EXE	28
PID 1376 wrote to memory of 764	1376	MSOXMLED.EXE	28
PID 764 wrote to memory of 1008	764	iexplore.exe	29
PID 764 wrote to memory of 1008	764	iexplore.exe	29
PID 764 wrote to memory of 1008	764	iexplore.exe	29
PID 764 wrote to memory of 1008	764	iexplore.exe	29
PID 1008 wrote to memory of 576	1008	IEXPLORE.EXE	30
PID 1008 wrote to memory of 576	1008	IEXPLORE.EXE	30
PID 1008 wrote to memory of 576	1008	IEXPLORE.EXE	30
PID 1008 wrote to memory of 576	1008	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Contents\section1.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d516a21c418f93aed5807c2153b3b4e5

SHA1
1097c283e66a591d66bb79fe401ac1f06a16c6dc

SHA256
8f7fe1dc019edaf7ca7a7db54e17796f1baa12be5c79a2ed0e917b8af5fdcccf

SHA512
3411a11db1043ee6ae899753005bb9010a39d7a4563382ea8019bce24cfeff86aae2c40c9ec10f4a6d737bcc404e598ae048db38cdd2e96404490793cf5af396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0e6ebec1d10bb9112af813817c58137

SHA1
f0d8349cd827cfce27ce0350dc88290b55f1d844

SHA256
77446b6f0fe2c9d206de7a5be9416e0070dc1e1be08eaf19c583514e47bd01f0

SHA512
e51dba0a081329240df87868cabce1bcce60ef2d99afb30362d47f32f9ebf379e8b3a96801ed26bcca993a4d87e4b9ce5cb9454bb854d96cc756fe6bcd7a0bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f9251b5f19339a8fc2b30c0badcf122

SHA1
5fd0cc2e0167bc114538939642e7c72552b8f410

SHA256
84d8cb7c3fe099df1563af8725b307e79af8c5bf9b07b079f9658aa050d4facf

SHA512
793b5c13ebfca6a0b21ff774b6266308de4c1bf075e7ac3c02c24f5b73a6c15551fbf3e825e4f628d237878fcf683e6acfdb07272c4436ce6b2801039e03c6ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
942a408758aafaf790a512998ae49032

SHA1
dee2a346823b6cf4ac1bc5c008d6a6c66764418c

SHA256
f3f31ab2d676ad66f3edcfc3be4b637cff2bcd45b116f408f6348e3765789740

SHA512
52968c36a81dccc517c69f15e9fbc560187eaa6fb1ed2072c8587b3c5314fc790ff2430145dfa5336fb1a9815e20efc2db5513ac05ea54bd0631bd44b3491b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44488843088b2d36a4aa25b889e224ba

SHA1
bde494bf300bd820210d12cf47455fa19eb42f78

SHA256
4d3d0e319da34869c62225053c8664243de9a22a322fd090b339807948f30371

SHA512
1135a26c6de9a86d30dc5835336fad7698bc1986003bd70b4d31095b7f400cd8b3dcb26a3dc6bb7712022009d2ddfe922099de8a22b8ecca3ba92df4411158b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cee2b781dd7bc3fecac0b7c906362625

SHA1
4cf6898306eed95b9dde2a9fec38d90a1db8258b

SHA256
67a07cf4d7e21869736df2b1154db192953714046faad0383af234c2e20c7d63

SHA512
4c717d3d7532e2113ea369cf299851674c2a1d26133dcffe32b3cafe5045f7373a0dd6dbe9922cadf4d6296256f3c6341ee83afeba4ad6863c60fca327bc1659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97a26d8e60d7daa9f524d232190cda42

SHA1
1546577730f30227515d679585dbd2e27d52b5fe

SHA256
1efee5cf5404b8f3346fd0c6454ba7e4af1dbda3be27885fbeb26653d3a14e2a

SHA512
53e24b419b84a67db1e53157e7b4b7a854f56d775698a86085ceac3e89d15b6f7b46abbd4f2d025e0cbcee662019d2c729a91eb6336df157d356dd4d07b839fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5e44fd0be6f6c3feaafce6b0fc7d979

SHA1
990a1f567ebec94f495a2fff6911077562c00b89

SHA256
e960ce39182a59c7afedcf3a59fefdd7a7a0e2bb88427cf6be2024ff1878a981

SHA512
51d3c41e371c57299334ee55e6aedc534a33260ff7fcb9fc936d4db4c4c9692c7378d077597da5b5b1486fd74ba9edd3ecb03879cdcf5546b54d303f11512040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BYN4WSI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6B5.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7B7.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6MCZEGQY.txt

Filesize
608B

MD5
03e43fdc96fcb138a7183fde10a0e227

SHA1
7057dab7bcf1fdd6acb7dfb7daa00571079457ff

SHA256
d3596e462c617412cd7e70045a2e38896edfb6077d87ad6c625bd5b06e134b24

SHA512
267440b94b61872daeb43edf4a6aa567cd804f587c53bb446f8944f314e409c6e62c12a4d710a302aa3b598cef689e3f55d30ade4026c32752fa89e8b3765dca

Download Submit