077177269b25ae9c1a4d9d02de7af592c16998f85fec2677abf4580555016146

Analysis

max time kernel
66s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Report004387684373278322023.htm
Size

1KB
MD5

aaab5260a1d850080bce6e01dcaf8388
SHA1

f640914743578ee16fe16d642892a85985d6d599
SHA256

077177269b25ae9c1a4d9d02de7af592c16998f85fec2677abf4580555016146
SHA512

73c9c9bac8e005159692eab1dc074eb0823270cee2a29c302563947d6f82cc18f4e3de70fc05467e3e37399e6a9542fe296b57ffbc01a4ff7ae35ce25bbbf142

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389817331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000bde066bec81e5436ef156027aca607c1da78df480316832db63439aa38066642000000000e8000000002000020000000afc2c3e64096d0d03ed398ab8e6896975ac78d424a06e8852e2c72dda51876e520000000a1eb4cc039cd18a94c350737adb89c16c54bff8fd9b974c3e2903c02dd2354cd400000008bbc899df560de8b537ea95d1edbd6027f9fcb8452621456e67754f8efbf1a7dda97d912ee8114853350d2326da5a96d7bbfc4eb40fb9902cf3ae3d556631017	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bf6292247dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5EB74E1-E917-11ED-B9F1-F221FC82CB7E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000778c0aa9dd5371b3feaad1a9f34f60207d06cbdb9f7e48886c952c5e07dd122c000000000e8000000002000020000000b89eb7e45527f6547d3ab8ef3e310012c06e9a9df05444c83af68955ef522bed90000000078b7cb47fa9f5b5166c5410bbfa83089c73e770ad5db519aab4254d918d0324ba46bcaf6de99dbbba65532c1d4d1a15b66335fba6703f6babe94017cda42224793f2e3dffc741843b2695815acd9bd2d53a8cacc923a2e44eee9d5154563f26623868f4c3fccb684d70746405fb03fca62eeeb9d1cb2d715c3ac4ed2c58ad76eea2a96f38e2561b306c13fa6d5dc58840000000474961298e9015becab1615f7f9ea3f35ffeef21f09a3f53064103fda6d9734ee3d65c0ef85cf9d61fdc5f0d04c977133037f146382977e6fbecde1d5637a10f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 368	1708	iexplore.exe	29
PID 1708 wrote to memory of 368	1708	iexplore.exe	29
PID 1708 wrote to memory of 368	1708	iexplore.exe	29
PID 1708 wrote to memory of 368	1708	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Report004387684373278322023.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
308b11635d8fd8daf81194d88146df71

SHA1
b32197896373d80ca08d3808c04639ad4a1025f7

SHA256
620d25279e6744031466112020bb9581d9cb897f20a36c8d80ef0499a9b137b3

SHA512
5b4ef45b706a727e5028d89559e2a2e4fe4ce47adde1d825c9a7fa79ee75a290a7a930f3e5541b056e473fb7b7e30180151f1e5b451ccb449c09468a139778ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed3776bd6e58568d704205d17ec30a73

SHA1
3fb29af00ecf865ba3b4d7456dbd810fcd0a38ab

SHA256
a3d913ea991f036037fa6b5dca6007b2103ef3f23398674bcac976b9f9db2b9a

SHA512
2cc3c7baf72c7116a62c3fb32aeacf4214a6d83ccea4fd37bd1aed9ad8c1c7de880e15e43e8fc744f13074a5ff164a136652236cfdf2b23746899d10da2cb496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3bc65f2bfbc7bdff71e3d6063990874

SHA1
d0120c0512b536217a8871dd954e6bc4ad06e2f4

SHA256
c25e2fbc25696682cd0c174a5b15adf0af2ef1f6d23953f13d8baeaa9f06a011

SHA512
dc86a234b76786a63546476ad491897f6df46e87feaa3a75f780eccf31cb905c826beaea26c9f396a0cd2381279d7f68eabd014217ee1d7aaa3b65b4a8532db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abba71bf3892a91c977c40131b0da95a

SHA1
72cd716b0109c68a7eff6e7499fe94a9ca2a3895

SHA256
8b0c7e6cfc2c21ee2070d5900142096f7585904f8005c8dae4778cae9bf789d9

SHA512
bc7e7a1cb26caf8a298c17e49b3f35aeef0548086bde7d5980be0245aa71c0f5e30a5c8ee76f1064f0e31e2fe24d10692ece2a3c105b1e231fc9d2e2114517fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fd7025467ef212a31585c76598db1aa

SHA1
59e91835b3d98a6405323d29fdd8a88c3bf2a8cb

SHA256
5d4d8381f74b87c1d1280e3018ce013a53160d54050b31baf198bc55a869b791

SHA512
50291cc68a386c4d5afeb41843f2d8cf790cd549f00792dfda133ef03c0ee12b0abbe8793b4dc4b3b25b133cd3a7e56e6981692daa2d1ad4b64a21fec4b7eefd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22881c6a7c51e32bbc522b7e0d29e9fe

SHA1
efbae69720ef1fc9aa4fe14f89fee1ca0c322a67

SHA256
b0448a1e25a4862ee138470739026472b8a69cf5e4be14bfd1e956b8b39f3c4f

SHA512
abe5f06d83d108f5216b251fce81b342846176a909a0a6c04570d9a0ff565d9866aba24b92196cbae8941d7a958a08ea43be6ce731348ae18d4cd9a8fcf44c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369dec52964ab55a34687e65c53bb5c7

SHA1
139573f36df78f57acf0674c6fbb803dba67d0a8

SHA256
df3301ef38dba30b14d699052e88dcc6c8f6a3f519a96e23312cbad7e72e2506

SHA512
c70f09280d71b6d90accbcdf7cd0a1acb71fd078f3aedc185ac62061278d2f63a20adfb54c8d3027ce6890a5d61252436f9cf2d624abfe4cde3bf878d6d1fd95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d3f4c659d872af4d9a2d0886fdf11c

SHA1
295315569f67789ddf92e765594e692e23764d50

SHA256
66f7aef5f3687f4dca0a24f6d3a29a2ef29aa8954de31a2c1fac625730bb7768

SHA512
9619b3ce702ec0768bbcef12508027396934b81a30f820b6e6627a6af0830fd974e7c7e45563a0094c1b5ba16850a901c101c8eb7f30c1702dbe885e3fc478c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005e7d511cf192b1f061666b368e2f70

SHA1
50d34802325f8775a84cf2c30547ce13d753c1ab

SHA256
8a76fe2076ab402565cd75a413a0264827cfc9e5024cc84c6e31977c1bda5ca5

SHA512
a2a10c1001634bede3fd5bc11af015202b5530769a3b9bbeca685c4656673a16611f956c3a14ff49a9e329603574c35e2f7d2e967b10f6a6fb5bd18d08c8c0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec55e53198c0945e30170a6268f0e1f

SHA1
4a63012f3883c03cda6143a2f8c52acdbd6a7781

SHA256
cf4c94c7927eac27333f2190ea20102f9f54c64f879cd1a0501497583aeda9a6

SHA512
95025f75afc8e4fdf7e5b8bdafa8f86f30caadbce98c2cce08b51881432e48dd9524b1ba4d270a4556e57053df3a04382a3cf7203ff37a7594d7ef9432a12d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b58ef8a5faf92e5fafbf2fda78ef74

SHA1
c5a876836f2ed7ba33a05a50da5f556dbbb8d375

SHA256
fdd3b15741438f4d00790bbef47345426d47e20f8c73349a95611a8202c0fbe6

SHA512
24581e20a0de113e3127ef23e1584aeb27b32faa8137ce2f5e7da1f94ec36b14d3f180fbedae68c949ec72027806659fcc784d72bdb0c1500ae3f452a72f7326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86c8c4f9250e52d98f97ee005a8e470

SHA1
7a6eeb2f60f11f5f15439679dd38883bb95dfbd2

SHA256
091c119872bbc0a806ff8f79716c4b079b6e4d93f23db0825345b218b17f7a98

SHA512
476ff4658064c8fd5da1f9b8f8c53063097b69bad06245e6d1e3bd49720ab41aaf7ec402080ee1926de800bae1fcc467fe8912e336561912d1d69a631354c064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B8B.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VID2WKUR.txt

Filesize
600B

MD5
49686cf28995078a4d8508276c10ea46

SHA1
8afc6e65e9ccf6d737de423d0666b03032912ca1

SHA256
6221d69a5317949020e16f5b74f04caf8968a90f4e36ba276295dd8420ecf464

SHA512
aa2cf30278fd998aefdf8b560d5a292c0061319a6940cbc61ab88e15a8c80d5575f06b91c118c06f57e23efd90e152bebcb81d2f3028c08e47a220585017014e

Download Submit