986c071feabb74f5805428203a84f7bc08df4812de0c32aeda063f4793bafd13

Resubmissions

10/05/2023, 15:05

230510-sf581sad3x 1

10/05/2023, 15:04

230510-sfnnzaad3t 3

Analysis

max time kernel
145s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/05/2023, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.xml
Size

238B
MD5

2b8ac41ca40d744a2aee10827345226d
SHA1

7161f4cd44a70e800cb4e6790c0e5dc105e89258
SHA256

ce2fbc82f71fa524d5690ab5cca9feb7f6e047af949e9bdfa9f5e86b36e78247
SHA512

48ed9ab12a330f00905aeeeaf71136338880e4ba48399ff1f52dd43693657982b36b0ddabf0e9c4f8cb140902e75bce7b2fb8524d3772db0d76c1e54fb8dcea6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390503251"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE03B231-EF54-11ED-8416-E6255E64A624} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a078946183d901	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000029c29744e2b8f3354895dbbab5b4439e8ec0c7145bf6cd62aae718656436b71f000000000e800000000200002000000031b7ea54238c8de700cca12ad5dba84e6f1e724f0242666f1561ecaf7b20b047900000001ac21df3f12c53789664c8a70c44544b9304a09d216d3543a0e21a40b73365797beee8a9cb8b53119ae176c69172839679a0fd65df41266827da4af126fa2cb4e766b9d3cd67e0c5b6e290d053cfabcc4124b5f82f50ffd6621067825d4478bafa88b050e63487dd963c8db313e4168c630d566b01f40739320da83ec44a8b7b62022f85f64604977c7e8c4fa9112d584000000099d8b8dbec374a169926ee271b939d7e4546228d1a519bdbecef5e1ae09c32bc4831a15c79556e0b34f2c9c55cd1585bb039609cd919d16b8498c20671487f45	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000027439a070536815d4a09b9c34dc8c6898a0721840188dfb01e7efdd371cea045000000000e80000000020000200000008bb1eb347155df64824cc722e9746f58e8614f1bed87fdada85daf56ddf3fa4320000000337922bd216197f1386fb20e0fc12050c4519970a37d32a13123ecba456c256f400000007ea5e40bd06ef7cfb8f427d10e800a01db60cc55d9c6a7537d5e6d46eded2ec458f20280f0c52ef0fd4e6d12eccc68242627ef2170071332057b930ef763d371	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
1488	IEXPLORE.EXE
1488	IEXPLORE.EXE
1488	IEXPLORE.EXE
1488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1492	1728	MSOXMLED.EXE	29
PID 1728 wrote to memory of 1492	1728	MSOXMLED.EXE	29
PID 1728 wrote to memory of 1492	1728	MSOXMLED.EXE	29
PID 1728 wrote to memory of 1492	1728	MSOXMLED.EXE	29
PID 1492 wrote to memory of 1176	1492	iexplore.exe	30
PID 1492 wrote to memory of 1176	1492	iexplore.exe	30
PID 1492 wrote to memory of 1176	1492	iexplore.exe	30
PID 1492 wrote to memory of 1176	1492	iexplore.exe	30
PID 1176 wrote to memory of 1488	1176	IEXPLORE.EXE	31
PID 1176 wrote to memory of 1488	1176	IEXPLORE.EXE	31
PID 1176 wrote to memory of 1488	1176	IEXPLORE.EXE	31
PID 1176 wrote to memory of 1488	1176	IEXPLORE.EXE	31

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Photos Library.photoslibrary\private\com.apple.photoanalysisd\caches\graph\revgeoprovider.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a3931f50cbeb461cd5ccbf2ea89e36

SHA1
d388e9b6551b39cd1761bc0ab8e6f3417944552f

SHA256
ddffb9e2d5bf8ff03c88dcdd4c6fe88bc65c3a2adf12a3ebb2e6114bc72c8b5a

SHA512
1bb6998da7e4ca230a1b5aba8ae355ebbe58f01d802b25146707676bfd4e5fd9bf37d2b8fc9bb6cf324a7477a4731f47e2f9ac99c5841da7e238abf8b028b45b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5fa60448b1973998209a8a7b899b882

SHA1
13b0c3500f3c18aaee767203d9abeb25d4a48c4e

SHA256
b9253c1d66cadb8c9b0e21b8c714327995d2b6edb634786739c841d32c7b4476

SHA512
985e6328604be69b8c25a5b8165d2cdbfae5e17ebcd3feb9f74bcf6e796bfe9d1ed9b8650f6f0291d917e43fd6c308263fe73b331ea75e48af85bb87d94bf9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb2390003be42608d919718e4f471236

SHA1
7f5cecdf7597fc3bab3915813ef2ea64755f2c15

SHA256
bb83041444e8da44b5ed42d43ee72cda0e239bef0249d9f76b130bf7a9cfd68d

SHA512
c7024fd460852c87c2eeb9b31fc2a401d8a83c78f510a15c6886a3494316c96fdb7992d522bdc731e5547d3df9c1fe5c6495c7669e4a6021613b2053b22221d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fe2242ff8a81ee902a6348c568957b

SHA1
799f09b2e746db0448f6ada0b5368b34a10ef481

SHA256
a68ed069b030f3e7061dbf770ed08a54b4de9c9c9e80d76246b398b689ff4c0f

SHA512
a06733df1b84b1cdde8fa0a0a0dae982b421ab981008b604bef2b741c389717c6e6793d01c89deaa0f0dab2297f2239ed9f7b4204bb4a2506faf95203c2d0dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c1f3010d0f0bb7301ce23a424e1de5

SHA1
70e4f8153fb9289898a2d0ab73499368f986c583

SHA256
3e792b60ea29547282dff284175719343fbbdd3840f0f51e33c1c35e836b90aa

SHA512
b5ce0d79bbe7aff6e4d01a81fba6c49a225d01f4e81c4da9cc2c8922a2083c564f6a33008cb44f8dd2af01a8df7c6efd83d459d9ca298c61efa31d7255dd2ba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9ade8a74df8039669d2aa152a159f49

SHA1
350eb08afa253c73c708dadd56dcd77397d81933

SHA256
56718cb159b9528790b9a7f00423f815087470fa425d94bc46009baf2109926d

SHA512
ef9d0948a6f72b7c16790e5ee2fe4a3d0463f64109028515cf3c993a7467ccde0771c80403ffff0ad0648e2f8288ca69ee1fc883a5aeb3d43c94bd141a82ba60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a1b648f548e0b74599ece04b8e86c12

SHA1
93e351fb188056591483a03044800e153604e005

SHA256
9747c0f87b0c0bc4de8c787f4c7ce50b1809e65ab65157e0e0301ec4ee23311c

SHA512
2e643716e20c78bc1c04b6eda6ba69649f6ffc6995a550331f16b2e1958d18ccc34e9555e1ba300d433014c77075c0b8798d1049469b8f59fb5049ff3f92d2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b08df125e6d2fd6d3e79c3a6167542e

SHA1
311e7ed01fecf1764ce3f7f9e48a71f928f4fd43

SHA256
cdc6263a50b887e7b7444e4ffcecd27e858f2e9c72f25f7b42d31dfdead32225

SHA512
021dab6ec1417e55573afef4efec236c0734f89dda179341400eb1621bccb4cf3c78e1d546c099a86b250e425fd490a2bc14436991d0c622dbd81d6bfc40eccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f46fde010b0457719f42190961206b81

SHA1
f1a0e46d806eb195b341e6fac3a5ce249b4ea0e1

SHA256
85c38253b8bbeffae6902b073509031e3847a488afa731ba44217a22fec46bdc

SHA512
648c3879239a979bdb57e904c3a56fe0141f67a60d6f3b382a511f006dae312513e186caf8abbeac2eb2a2fc691ac041e29d15842c6566a18e05fbd43ec1fa24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab44B1.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4593.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VLL1VU4G.txt

Filesize
596B

MD5
065f7fd5404a8b06c3f521d9719333ff

SHA1
5bec737555393a00c2dc9f5fe350635ef83fcdc8

SHA256
84c28d46cb6e26af99b154d8a824e47e393213551b53f3292efd68a563605f91

SHA512
b5977d7f4aeb2ccb89d29be758ab2f3f5c4bb26418706e1299ffd457d2eb46c6258522613e26ac5982bc9e3cee57ae928b2e99880ec795f66c575052e65d2bb2

Download Submit