37d198919b40935cfcf385b0d90f9d3b6bcda35b2b2d29f80c2e1b8103a43312

Analysis

max time kernel
98s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/04/2023, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mt.gov Scan_Pdf.htm
Size

131KB
MD5

d2f9a3cbb3db59bf203ad0f0540f7ab8
SHA1

57b429d57fe497a1217757d0487c84cdaff07cde
SHA256

4fa3daa33f0b90dda68018ca9b7eef67e57e24763e4c72c7a9e6db84b7d234ce
SHA512

d65f44a720bbf20942954dae3e54c3f171024e91e0b60a91c0667baeb75b260cd4a3afd808c2111b82b435004e6eb53499c92f1a88ade3f9ce3f083f14a608be
SSDEEP

1536:c5KvydRS9Ni1x9o9jPXhrDC7fOScXbzXsAygc:co3i1xe9XQ7fwJygc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000039b28457e5daaacdd89186cf26471ef9ae6dac262d5a0945d47dfa9c228fe06f000000000e80000000020000200000005a08498e25969e2368295d1ac1bae2d7c38391cf608390a015a423dd0eedded3900000008e0d33372f4e704d145e09fea17469af9f108ed778e278c004d7f208cc85e3c3c42905f14fc7bde0cd094e980f04198c9f039957e37eeff5749dd7e39dfad3ea990b4e2922507dfc4dcf55d468d528dcb55de424112c2d279a751e1b671c2a03e355d2df0e880c278084b38cbbbecbd19eee1500969850e589ab4ed1039f40c1c16c7e44574f1a0f23f91fa52c373f464000000080dbe4bace53ebd2ffb31e5939db72cca03ee3c0c0b5801dfa00d1fe20ed22616b52507c1b7ef47ae7d3fc10bb4a8a546a874380a7231c078d8e10a0cd473d9e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E16D76F1-D8AE-11ED-9F32-72D88D434236} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602d35b7bb6cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000c079da2f1dce9f3ca552094587cc94af1143ef3c879a717a1e1d865a95396fd7000000000e8000000002000020000000d05389a4a18803b9239adbb09a170d662b59cd03d01d226f41d8acd262ec1f7220000000d64069ad93a7fc412163ccfb434ecb368f7b7b87687bd57b11d063c5914b32d54000000057c2cd42a599d7a123741f5e8054b0e3d0b049fafd865c0cdfc44e310aeeec49183d51ef376dfbb593c697e14b98c66eb5e8699d167ac4d37029f594ab6f2305	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388013089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 852	1712	iexplore.exe	29
PID 1712 wrote to memory of 852	1712	iexplore.exe	29
PID 1712 wrote to memory of 852	1712	iexplore.exe	29
PID 1712 wrote to memory of 852	1712	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mt.gov Scan_Pdf.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d965e1ab5f7540458db1ef3eacc603

SHA1
9cac4cd8c6cd9b6d4d19fda3c25979d654eebef9

SHA256
882db4fdf9ce4742fd3a08d1fcd6a4b142a44c8f552f68b4d003eea5e3832e9b

SHA512
ca1c1efd5c89e5ab4ded9bdffe12922ea6af2ee828e46f5e35a0766dfffb54a3f93a94609252dd9f37c3ab4bde2e1b9c162b6c9d9b203b83c1d4987a1dc9718c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c807c4ff9fcbf8d68ffdfb774b30217e

SHA1
9c72c4deee6dc0861a1beb036a857c42b107e926

SHA256
aea394c07fce5ee2ab53b0e603814aaa152363c7ca8b1f84262aa05373e5a84a

SHA512
c0da108abe501a48b4b0bba6f7f87158919c50ec5ae6b2ea407b98d2312ab7ad0a64040ef62944219d4c1fec7dcef77303cd24029548a4a18312db65972f9f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7cd81088a4bbfcbde949ba54acc1a52

SHA1
fc151807edb1b94a3f09fc8cf4a08d456303cb34

SHA256
76ac9ec9658702395bb3efcc0382c9224c59640d83db8302c1d05566166bedaa

SHA512
806d44b1468218e84bf8f9ad7447f32211aeb29053f184c0298cd974fb499c1214dd1b719abae8746c6cf8a4c403aba9d96b9407259dec6eb0ed472e07a23c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
334c970a51c3e904a1ac591a77b8031d

SHA1
91439b4da2ca6826242994914e1a1a01ffc80c52

SHA256
4a786c365e1991b9b2bf14d67413f4a5b2d7e43223af79e0330eea1e680175fd

SHA512
f36dc516154d850b1656050836985a1fccef22033a8a8a3dbb85de77d6e1b61264c1034338bb18a383968cea3132c2db1356baeb844dd1e7fcf12ec6e12946f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e32e58349a2f38a1a46cbb68e131a3b1

SHA1
b168064206b831c98dee5d0cf97218c2aa38bf2f

SHA256
f53d58eda6136175dfcb3612a432a9095feeff49bddd04438058f8fbfd99ec34

SHA512
9e828250ac0e7d66522c26dde0ce2c36e35e46d3425931492192bd40ce5d9d5977cbb1a39280bcf709ce043b7009f4e14fe641ff5caa4f26ff636e9a2530c3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a604e4c65a30bc395594bd8c63cf9f4

SHA1
73cc1ccb85a138b92abd16f78ea7acefbddccd8b

SHA256
a3711bf03cdb8771fa9e8fa42b9c84ef96ac36f1a513be9100f8aa58eaed5284

SHA512
dcd2a45111fe95e79497b1e35acb14ecc095d772d2ec8f81ac205098b2dd8f015430e788e98982d586bc9012a93be8594bb0db35bb144481bab8f121f70d48d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acdda364e634292cf3b9e470a7cfc64b

SHA1
e5c867d8356aa1feee13355abac4679bf2821d53

SHA256
9e4027c63c4eb873cec1e75fe0bfe092a5303773c917f8b95e2916f798a7f7b7

SHA512
3506f03072d862c48e6cdc47bb0b9e62c23bcd2ff0b745bf6defdcb11f3ee14e383277c1dc30779728dbe91526e58d4ad931def21b24c8c2b111e196ee63d4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ec945475ca3de8e7b9abcf52a42372b

SHA1
2b95cb849339745759b2f132040e5ecd69583806

SHA256
277b466b9e8eedf2683546979a89844da43888912a87dc4f22638485cdce8511

SHA512
00cd84444c7279edf5a9de41c6b79cfe2ffe4c76e12de116c23fce20caeebce99265d6d638f1d4e4484bf32b1df5a03255bc7c37efdd905a8f1f77f39e18bff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec3f973b7293cd4a5e7a9fb7e1fbd98c

SHA1
bbcbdfad90c0441d482dbaaf774642ed810b8180

SHA256
59768cb90febe17a557e2f0b20745829670432783d98be6987749d63af08a759

SHA512
f15f73e303fc664a7a37679dcca03b111054beb776bf2468a15b725f33e1d93660fa62e7f6a8c51822d0897a58aef384408564bf64dfac080530397a9025d60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab426F.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar463F.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HR9V8CZU.txt

Filesize
604B

MD5
2dd151533aab097eceb17a3e7cf3efda

SHA1
4bb04d33964506b27ce4a533c8b60894daff5d8f

SHA256
17a188ab1c4ad18d7db3657a16702df741df6fdd50636810b26912d17fea4898

SHA512
c9060f6fe6ef7a38a1c748fe4c767c6325c2a43daf26fa0b145afe67499c11c2a285fec17a2523387df84dcfbfbcf15c51750085f89ad2af0eb3067b5637560d

Download Submit