96530315fa4e725f9f1cadf145b84119a53911944bcd4f92e2b577d30c5f98bb

Resubmissions

18-05-2023 23:26

230518-3ey4eseb49 10

Analysis

max time kernel
118s
max time network
155s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-05-2023 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anarchy.exe.xml
Size

530B
MD5

c7a4606f8f222fc96e1e6b08c093794b
SHA1

2700b3727ab01d93e75e1e12f308dcaeb1d37dba
SHA256

32d656a69b19be98ae050512a4d0f49ebe21b6f7bb9c50130b7e952ea4f5239b
SHA512

7516375b47536a51ede8079d25760e0142ac93077326b6cc033fd6cb1676b65aec7edb3f702922506f2b6b18992cd219be01e7adbf70c6d13404adceb410472b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203d8b20f189d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391224609"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f0000000002000000000010660000000100002000000076af9e4c0efa275323e3a358291d75cbe1c5e167fee6c77ae2f18a9f2a14d6af000000000e800000000200002000000053de7a2343b79b368aac27fe90275109ba0d8965457af2b6bb104bc3e378f86b90000000e292250fd83261417ad1ec4d3f91217eecf689e61ce02637f9f9ea60b2f9dffcdd6c9e0eea62738bdc85102f87a9e0359bc3d60c6d63d629ce36a4f39973f237f9518bbd419d900ed1e7c6236854b213dc39132651ddf72919d9a36836759cc3c1ab620ef4e49fa9fdbc2ac349e000be9a91f1a8ec7467e6937ceedef626f53176ba90c704638aa61f39dfa646aa1c6140000000b1665f270eb92a1b585711409a65d5da7cbb56a537ca552dee38d4b4ac059d60692ba820f16f083b31d20ee64789f21a923a9667aebd499685fdfecc174cc953	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f000000000200000000001066000000010000200000001044f245238129e02d38f09886d06ce5edd80f2ad876d710ae1c6526143b872f000000000e8000000002000020000000a4f905cbb784b10084367495f25e5fbae58566ea8aee4229bd7532f446df74d3200000004aa94b626233068b3dad16e884036f0e06bc7050a204a49e578116b76528b5e940000000e8c355f9bfc14295bfd1b1c11ac071bf38ba5848a901ed28b1606ebe81d74653b0afb629f8f3e1615bcc8b3e2f55ffb33622d99aeaa9df5336bddac697cbf00a	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48841E01-F5E4-11ED-8202-6E0AA2656971} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
524	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
524	IEXPLORE.EXE
524	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1868	1356	MSOXMLED.EXE	29
PID 1356 wrote to memory of 1868	1356	MSOXMLED.EXE	29
PID 1356 wrote to memory of 1868	1356	MSOXMLED.EXE	29
PID 1356 wrote to memory of 1868	1356	MSOXMLED.EXE	29
PID 1868 wrote to memory of 524	1868	iexplore.exe	30
PID 1868 wrote to memory of 524	1868	iexplore.exe	30
PID 1868 wrote to memory of 524	1868	iexplore.exe	30
PID 1868 wrote to memory of 524	1868	iexplore.exe	30
PID 524 wrote to memory of 1988	524	IEXPLORE.EXE	31
PID 524 wrote to memory of 1988	524	IEXPLORE.EXE	31
PID 524 wrote to memory of 1988	524	IEXPLORE.EXE	31
PID 524 wrote to memory of 1988	524	IEXPLORE.EXE	31

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Anarchy.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:524
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:524 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00b02177e80f08346dcb4f9aa0a2c1a

SHA1
3631117c7d87adc4636880cf1bf5785225fae9a1

SHA256
e031da2f742ba54d0849c60254771e5c5c2603d74bd5f1ca4c68cd6d4a42345d

SHA512
c07a883da65fb7d585a5039c108212a86e1400cda3dbc83beebc48939812a1dce7fb83282afde0eb582c2bcf374574cc3f3889d3c9cbd8ef5f645bb6d23b2d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aace61f9257e998da4f0cd97f8c264cc

SHA1
055401c6cb7e3094373667ea03bd44dee4cfc637

SHA256
d34d863538949fa439b71901dfd8b6d394b4a481bcd013474b4a99c1c5b54d26

SHA512
fde23f602e587d1198e1b950acaf8b5b8539be82fdc6ad1b2f1224b2c5556f3332abb685787c1906ca0b71ecdef68e72ee5b0768390e4f3500cafe038740761e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0985914660c7e369d63954ba3f8c44e8

SHA1
d1f09956d2f794f94de07833dba760ac10393d88

SHA256
0fa338893b82206daf428e5ed51cae84cb5c9d34653fd015cb2179f960745185

SHA512
f0f0d95f4ee8db40ace57b1fce48c8be349dd04cfb41bfc20b119d73f6d3d123156802cd29a33c75017beff5d3c454286e5c37c5f4e601ccaa456b2b984b4ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66eb07db9a0a31225c9da77390dd5c5f

SHA1
86da0e5426cce5beb1c5ad888b817ad9638cc71f

SHA256
071c0169b972d708aa56254881b2f6b041c516af326f0bad636cd6e026514c75

SHA512
a5c0c9bb15bb8fb13b6502799a6da31ce1d06cbe4da48565e82c9f994e3897ea6704488fc9b77355f338312b27a1bc71988154137aba21a6d04f143a3688f765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5967ab6b7f1d88f6a86e0e8846c1f49

SHA1
0049b535ec978ab095128d521f39e45b68e97d8a

SHA256
d3f369464ac9ff89650a45ac4dbd553154eb1ea9b0f07fd64aeb38a7f6fce972

SHA512
b3fbfe2d5568f17f2c61510248a3a12ac385cd33e2f79015187f5a022f4d01674c8b03f0d1a3852d9ee34650616862031ff5929f7a520cfa8c48928cea693980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d54d8de42b4d8c7bcd681825587edf08

SHA1
b03144f524a43738fb4dd21daa1b245d8acce11f

SHA256
82acf57c73add473f288ddd902fa7dd262616fe052d5d41d5ed2adacba01ef38

SHA512
5c4dfbaabadcd863afb197c9869977165a0d095f34a5f4fbd191e0c6fe6a524fd0ba2972df2cbc54f1947abe0a87013668c2bd03827795f42a7e4ee86327d4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecf1edd162430df4e69f85747135e3a

SHA1
e818743ea6c1e249112a8e09d70f3b1d76aaa7a1

SHA256
e5633881d3370d97c4202c3a4442929c449ac18fe77e4e777a6ca314b5dc9bfb

SHA512
73267e3918233a3cb7693c0bb118df1f270ccf4e717f85a9841ebb5e9652def8a09a252680f6f103c3c0d2e3d032c722a549fece92c4c61b53afe0ff700b7071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f57858b4198c068991842c0cbcefa5

SHA1
6feed6b5f7e04bb126386e747b3a817f7e7f4f77

SHA256
056ed8a1ee9ed138cd4aade8acf8d8d1e4152ea3b5a29cb395e36bc9edf5e71c

SHA512
cadafa269b067ffcb0ebf002c161d68f1d42a6e7786e9106809064fff8ea6a450cd90274f36fca062d7465cbddb3893efad8b5850d406fab7e37393f42fc1711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95c8114858991a56cd00f584f1de1e5

SHA1
33a415386d3e2ad5a518cdd764457e5745012843

SHA256
0b1360061bdf3e110728fc02d41e31de8610b8d9589f9517f2651f966f732a0e

SHA512
6d993f57b13902d79f81483aa9fd61eb43f30cfcb9b3b23d98ff78f8ace74f0eba8984ce3b01ddb01fa8a237c62bcb43893d49e9399f272b11197c513eb499d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGZY45B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E83.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F53.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FA4.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CQVA38KB.txt

Filesize
601B

MD5
7ccb14034c823da8e90372e55b886f2f

SHA1
3602fe1b3e09b07b22560ff2c257eeb22602e7e3

SHA256
7f42f0e782a75bdb04f5d8a2cb453b80f8b65a9c2f1cea1e6c541174e592003e

SHA512
fec18038ea08cd621005ae7685846a47724010b691cf5e122013832fecf0dbb4628d8c66ef9e56e6b4cf76fdbc27ba32f52629efbadabfe3d581ef839da7e7f1

Download Submit