hxxps://analytics[.]twitter[.]com/user/KulinskiArkadi/home

Analysis

max time kernel
94s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://analytics.twitter.com/user/KulinskiArkadi/home

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F11025A1-E2A2-11ED-97FC-F221FC82CB7E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c0000000002000000000010660000000100002000000068e1a7dc98bdf64cd8caa335ae430a1274320d6b7a20ce7f596808103b298945000000000e80000000020000200000005b0a495de1a17ffbeb56fcf1c2be2a248ddaef6e7236b0e42fcb19016a0d441f90000000fad5b09946dac1a52fd5567b67589c7fcb2bbfa96f2f37d4316d092ef4abe34af501ed68505cf13a3843674652df9187be3bd2c27df7c47b7e652f02b6697c60cf832c54eeecba707e5f9ce7b0f063f5faceeafa1099e0083146d457fd458933772912f24ebfd0c65daec4d3cb83fb8c230eeef12fc1009dd2946d006f8cc03d228314793f2961a798d4553827b9ea2140000000e20985eba1d916cf76ec4e8bdcf77918f54c62f60d94311ed4983a4a9074a37ff64d882046265cb6c30e61abf000b9a857b9e5a5978cfefc25f72438b0ed1974	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389107472"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000eeca228baae2671e855100ed9d6a2051bfaa607900c1573bd9cc4f63f1591933000000000e8000000002000020000000030763d642be3fb638b1a6f35b6c7f75a01f0c21022edc5a6d7df62385bddd9620000000c5854f801b679a570de0d888dd0bca55193cbfc8f41b4a2edd7e5c72d5110e7440000000381b623c35fe9a7a87ca8a274c9c49547796982ecf1d53897b963bb95da98bd090cbbe01981869c6e3426a8e8bdb28d142f03dbd4636b5475abb4fb666e6603b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206a8eccaf76d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 564	2044	iexplore.exe	28
PID 2044 wrote to memory of 564	2044	iexplore.exe	28
PID 2044 wrote to memory of 564	2044	iexplore.exe	28
PID 2044 wrote to memory of 564	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://analytics.twitter.com/user/KulinskiArkadi/home
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c7f4c9d13477e68bcf44ff77e5a905d

SHA1
9768aeaaea6312075c3dc2b29a55ccfc26b2506c

SHA256
fa1c6490b343ef82d1340e54cf7f031602a0188827190ff85a24ba105058bfbd

SHA512
55e8e6b2bfa56987bcd052e373603361c44baeeb675213f1c6529c7e56e7cda6ca21f677ed2d401ef5aecdf91c6cb54560c2ad0f20ee40bfcd6fcc99afe09c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
550863ee377bac43b9e7952c675873cf

SHA1
2ef1704e6178d0fc9164697ee23aa190e6b39c44

SHA256
14c9a44b01f63eeacdf914a8fdc9cb5ee159606c900ad3fa9f12b2c9beb676fe

SHA512
646c9547be97dfc87564aa185835e44626560a783ca454d711a0644eb18ff7175e9e15b626d967ba9f5222c8a1561b3bd85422eb150d1b405cf9a870b2163eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
81cf8ced1df8f6fea1ef6140317e8551

SHA1
fef3e176f3e50b5146216b3b2d3e25bfd8a0bf99

SHA256
140842bc4f46bde9858fb45ed5572df5c216000c760d42b8cdad657fe91c1236

SHA512
94e30dc94b65bac073108c351bd1114ed45fb815f017b9fd94c9e0eb1849170320aa3fb43183f173f0d6a890505a8871ffb1d5a8a1c7c3b421279284c1f7f7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f4e574e50a5abcb871d1ef46a6683446

SHA1
1b2877dabbbff25058879db0bc3b84b4ef7b0bf3

SHA256
8ab65b2609537541fb1ef12fe8117ab167bb4dcb6e1c32224fe1d3b0b83de8b5

SHA512
261bf0b02360f253fa481ea1fe44b873d9466712161fbdccb59abbd568187d8da20edc7c1b823a822159f946427d264e741113a8cf3740e9351c1ebfcf50a9e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c1675c4018bafeceebec3b3c116833c

SHA1
8ef0b3b75fb67a21948a34359292b7eb41b5e5c3

SHA256
5e0026a6bec79eebe4e9dec7769fa9654a31ba7078ecf1406fff230948b8a667

SHA512
307642e13f71ae8f8f321481b94ea496baf6e55d98ed74052972b48918a3e78568fdb3db9d9fd4eedfbc538488fb9c36e9dc1e5616c71438ee5fcee0fde6669f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a63daeba15894ed68061d754ff3e907d

SHA1
8cf1a906893dd6a1f50526577f704372da5703e1

SHA256
9ae8b2a298c59b5ecfa7a9d5b9e509adcad41e6f28e2208788b80a2fb74fdbc0

SHA512
91deb78acde1889c98280f39f86533e8ee2530dd0750e3d5a6d7813528c7c71abe2fb85b0607a3f7716d58db90af860c2b14b455821b542ec560d79de745dbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c17dca5c7e1213c15821b8d7d9c9a2d9

SHA1
b93cb826b8e16c6fbaadf518bfdbb7c7c2ccc5c1

SHA256
6d1d56c1c6d3d22ac1f88bbf1e657f6f09d7f7e4648eba786c02eb75f7cba731

SHA512
1730c45b6c72829488c1bbf67b76f08297716497f9fe0e6fed1ce9fc29957aa5f5cdca7d6fe3b2805e5dedcfa9fea123f78aa419270c8144d5621fefaedab1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
700604f90c792114c0d37a7bedee6bce

SHA1
f286fe80dfd4fee5d027556df8500be2fde7bb75

SHA256
09eccff626549bbecd06f2dbc10be39cad690c3ebda56c9c5feab04a1d876356

SHA512
3ada9e02f48324f5d0d1ebf54011a537db78f5bd3ec0d6ad4b8e7df7e96fec32c2149861ae9efdc2abf906c6aae86ed8a6af9613cef1e4d0de0bd58df1c3f0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E10.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E13.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F42.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RBLIS0UO.txt

Filesize
608B

MD5
43d5a1ef8ca1434af749ce9daf354ef8

SHA1
e30f34557b1261a478a44da76d63138fcf697a8d

SHA256
1b3c2f7e445d062a7cd2430f786972d9c66a1d3c1a1eb521b4459dd5a457075b

SHA512
9c8d21247cb0d102e09a7932e127ccce838566d511be7fbf8b0f7e0d755dfd5cbfe71ab69745d21a5149f334111ba493703d34596c1f087828eca7ddf91341c6

Download Submit