23a34c010849851a825a8ebb578580dbfe51e15552db6bb9098fc582845adb7c

Analysis

max time kernel
100s
max time network
129s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

4KB
MD5

0980dcfffecb4b14d9a3ee170c30b188
SHA1

7717ce7bae5453c20b4ea5161d326939a3d13428
SHA256

23a34c010849851a825a8ebb578580dbfe51e15552db6bb9098fc582845adb7c
SHA512

adccd9354e75099ad0500e613bd22626f43e5ce4ed3744b2b60f6cc3c22052516e9effa6715f5fce7488deccb67a85043295c5a0f9bd8f5766cc483d60105b3d
SSDEEP

48:ffYs7H/TH/N1fQjbIbiP02koidoB6Z19uZHG:5jjKbIWPh4dY6Z19B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391492991"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008428ee0e146384409744b950d4d4cdc600000000020000000000106600000001000020000000c1515423be118872d09a0d4e655b983bce3ffb249b255f3d90309bb5801a62b4000000000e8000000002000020000000cac996a66768aa7dff4720e95e507db2e929c3baee35b5b8b78853b3c480122b200000007e17614629282122833f7876e76930d7d6e139c74a35cf4b75b3195b08706edb400000001c25e18b1cb5b47d8bda44bacdaae6ffeef26120944510d340f176bbaab02058165dd0698d164cfb1995aab353d30b670de07515c85be5eb0fbeb6a88ec84cc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29053871-F855-11ED-88CE-F2C06CA9A191} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c58a03628cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008428ee0e146384409744b950d4d4cdc6000000000200000000001066000000010000200000002f4439b069b50c767f0a6991d61ae7571a1fab0ee81434ad2e81fcbc5ab460b0000000000e8000000002000020000000f55880d1609499c90c69ba1ddf561a1fd421283df9de86de0bcc619bf29972999000000038cefcebfca70527e2af42c30934d9d4426a3b15c3f6e1b58f15d8ec26b53161c73e5678fd0cd89484987f79ebed2f097bbd3f35eead2844b87c110ff105d4ed1f1c30ff598e7cbda4327a01ba91cfda775b1e26ca5abb73c4446997c89e5e66a27db690da5372afb8416fd72ed8e3407728585cc021e64d2805516013cfd23b8a1f07b53e9efec61fe827e3746704304000000071b09f6ec2c1972fb72855496968d975d8219b3da304f7c7f79ae752f5316df49052952a59c7f5cf1f5312712215f37a3306f00635755e2cd8c08cafaf41aac2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1384	iexplore.exe
1384	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1648	1384	iexplore.exe	29
PID 1384 wrote to memory of 1648	1384	iexplore.exe	29
PID 1384 wrote to memory of 1648	1384	iexplore.exe	29
PID 1384 wrote to memory of 1648	1384	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc3d905e927d33763c5b70b6d52a726

SHA1
92c03f10e5065eca22282653793e801da0d807c7

SHA256
b9429eae9708bc8a007a1684616c42ae9fe77b0913fff5765a59430e8466e2ea

SHA512
7a443eea179e3276949caac2da31b7fc39a704e07c2aefc615031642dcd6ecb7b565a9607f3d11c53157cb54e41307874d193f46884a580c81464014287312bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17ad189c7772ee976e5f6dc5da1ff76e

SHA1
2eb97463cd7e33a3bfd2c334f13a2e5e63d8339c

SHA256
2a80d955ebc2831d316ef945ede78b2eadb3a9210045bdc0b70420162ac3b33b

SHA512
70b439135aec5c72f26cff998ecb108cf02b5532e03cfd391a4d70214540a1750578e0dc60f6735309f767f594865d80e28793d70f8147c93c9ac925be1dd233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116de7b0b35f4bb3123558ce0286208a

SHA1
c8c28e913fdfa1364c4125a26e36459c090f21ca

SHA256
280e408a621e1cec27abcf758ceb6e52d83d04c05fdee039230326f997ceb7b6

SHA512
7ba5b288a3b5b424bda836be12534e3f3796b6532df684b0a57a3fe0f48acc86064761680de42260a86ef99e9373246a5256599907ec61039710df4988fab45c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec40ef941ac19015214bfe9b972ce35

SHA1
db6bfb3b3a5a5a987aea64d61186bdb68e1f818e

SHA256
238678b125743c468cb0f8c5d0e772e0262ef0372ca29e17fad8ad41b3308d14

SHA512
0cbc87d3932fb96143ecb9c8557b8fd97cf5a61c499b619e8d44caeaa0d37024c8f921766d09217b28d8c023b9e65e4bc97aadf77a80f06e532f5839a75e1050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4e8b8fd01226e14ecfe6b153bf8fd5

SHA1
6b59db8218d98be4a97423aaa088a25ac8cf34ea

SHA256
a50b303635fc69372832f05c902cd6b5d8d8b87d4d113b5cc75ffbd8bbec0285

SHA512
2b594ca5f4635056984dd33242cce0d0384b268b5f8cad5c513572e7022ade024672e19a2cfc438b7edac54f5d940bb00eb5a322b614757970b165be5bea4d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3645d70658bacbdefbf7b363ae2e475

SHA1
39b53b72553be08e659a7bde43b5d2c8614682be

SHA256
643b5d6961b21373cd01094bf37767744a36e1b0c3e586c485a29af7f8f9feee

SHA512
898aa43c3fca7631540d378e4480714a28ead6911d10768ddfc866ac32dc8d1a6dfe3b4bd6eb8875295c281b79ce7b5a911d8d2d277735cb6275ce658a84498e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b48b98c6294245d96eb3b682a6d3431e

SHA1
137bc57310e772cb9e331b3a3b8f9b6a17614b74

SHA256
670f6e5affea27887258ab545e2d1061c8612f45a11e6c9730eebe5b96618115

SHA512
71890f2b4468d8a5d82e377dc147c36328bc711aee487a2c64240b7b1aed66e67f61229fd96538cd7abfb6eda6583296bec55e7e4f8ed1852cd9ee2658186456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7bb19a66a45c898173eac75bd9d8197

SHA1
8678a9d4fb77f4e84ab7f2a1d96caddd68b8cddf

SHA256
af89c75aee47423ce09948a090be67681846f7129a2f4ac94f4c4bf6c4956e8d

SHA512
6d7b1b15d992d9dd0795b05e4a1760e0a066eb36bd0adadd6c1355101f5a1a03a1385757a36a97a2af6e0fa814e7e059fb237c64beeb2a26bb5ce093a2c1e249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3bdabd42aaa7b08ad44a96bd624e81

SHA1
3fadedd8b0278f1d49e27a955169c1f80a083b10

SHA256
cac1f097d03f2caf727a58009d0e74d2c75b120b212a19b2e0984c6e6e746723

SHA512
e3cef578ecc13ddaee7aa0d05f88497cae35d76aa47b3fc182501bf229da1f47b6d2c35d4a8797d49367f2e4551d6f9ad1e9a4d441b25f44cfe288f11d913720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cac3b68863e9d06bcad3825e2931607

SHA1
0cb44d892321074ee9b31389173aaecc0200a920

SHA256
aacc2b04ad3b813eee7c76163a73d74693a75922198ae27888fccbc7a3292473

SHA512
5acc4bfe01931948a2773b42811f8aa2f66b340bd9e2f842596906f3dcfd0d1ac5a263612719754d7e6a08af6aa5fc2bfb2b215245ce1525fe887623bcadb71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JN2GDFP2\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CE3.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4003.tmp

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CF6.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4FTJ3136.txt

Filesize
603B

MD5
73b0904887e96be640f8c5a4d9fbca76

SHA1
82e7031e76e14d78d90671161acbe96fd7920ea2

SHA256
7b220e90f3d2c2145933e8bbb4503cb8ee5a4da1815d2e007c9948f1c577bbc8

SHA512
2df348d4c22c099d75324473228ee71665b47849220354fd4ff9c199e77e2c6de559f0186c4bb9d686cde881f74fa75f8c3eb8eb0ba50d103886668747d7ceb0

Download Submit