4ba393807036fa63f4a84d7bb9a019ca0efbaedf5f901c71ea2f9b2db0d3def1

Resubmissions

15-06-2023 09:53

230615-lw5tvsfg54 10

25-05-2023 01:24

230525-bsr4gsff42 10

Analysis

max time kernel
102s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-05-2023 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_02.xml
Size

871B
MD5

b1f4cc6d1c954e73cc6e7d8b47c4db8f
SHA1

986ea9addedb45a0d3c8c6c70a636e870959b79d
SHA256

0b0c35ce63044f7756cf201f5978f44c439805e524c365ae9949994347487b79
SHA512

77d46d25ddf91c010f69ebad82800575b4cb0be4bc5e8199bd5d877a2e6a624e0f455268d8f26aaae2f5180a3c2b6dbe8bb782017c6e342960c1e7a26ae43d64

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019168835ad70b84caee2fe5f9accb8730000000002000000000010660000000100002000000066b9af2357bde5a884bb7c950d085393f5e734ea03a770786841f482196dc399000000000e80000000020000200000006f1237e92b4a9ca9f0033bc351f238791511993fe656902ad5a4e58c16a48fc2900000000315693b27d6636c44703b05dba2073a0f1a4a7c292352f1d80f0885129e3624f170ccb5012e49506fed449fe807b103e08a477924efebfcef403094bf726db60f0ee372f71d205dfea027f6e280f347e070d3f19ecc6137bcab0740c486d49d3b7754572dc85188d496003da1de3fececb44b31c60cefeffdb1d6ff84950d306a6c9a8ef89c988479657ca3d6f800b040000000b9e9192db36bd58606e8e1fa024978b204b6a2302eaba25971405922c009951ef93fd60bb6655386322ce76ee98eac350e0d622a7fedb5893e5ee628b3bf2691	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B50DC6E1-FAAB-11ED-B27F-72D88D434236} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604a5b8cb88ed901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019168835ad70b84caee2fe5f9accb87300000000020000000000106600000001000020000000be8cb98119531987d832b825dabb6d3513f8d85d20c36f933c3ad06c32ecaa21000000000e8000000002000020000000c793dbfe253c593165f070ea504662d2f4024557501ee7f4a8a49df87f20494f20000000d57a60abc488c91bd3cdb9a24b2b1df209ec8610e7c202c467873288499f050d400000008ac2a79174954fdd76e76067caf05e95e5b7c4b635b4587257a51f7907d6cfcc98c2508ea81f0cbc40d9bfdd498cbde149045554c0231970f8119587d44477f2	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391750065"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid	Process
1916	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid	Process
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	Process	procid_target
PID 1316 wrote to memory of 912	1316	MSOXMLED.EXE	29
PID 1316 wrote to memory of 912	1316	MSOXMLED.EXE	29
PID 1316 wrote to memory of 912	1316	MSOXMLED.EXE	29
PID 1316 wrote to memory of 912	1316	MSOXMLED.EXE	29
PID 912 wrote to memory of 1916	912	iexplore.exe	30
PID 912 wrote to memory of 1916	912	iexplore.exe	30
PID 912 wrote to memory of 1916	912	iexplore.exe	30
PID 912 wrote to memory of 1916	912	iexplore.exe	30
PID 1916 wrote to memory of 2032	1916	IEXPLORE.EXE	31
PID 1916 wrote to memory of 2032	1916	IEXPLORE.EXE	31
PID 1916 wrote to memory of 2032	1916	IEXPLORE.EXE	31
PID 1916 wrote to memory of 2032	1916	IEXPLORE.EXE	31

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_02.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dec095e58f4de32952ec0e013a74c4a

SHA1
d882be2f1eac0f15b64d3de0d7064b4c729ca20e

SHA256
54cf7e35936abe82e0576395f879789a49e3783ff4e5af8e5456708bbedbe7ba

SHA512
82574617febb4eeb24d0187841040e49906bbbadf912477e9c4bb2e0674512dbbc211b47e2985338e692b1063acbfec51fab3c70f62ed830d31205a2e9faf0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049e7a3f3164e7ffc24b3e00dbd2263b

SHA1
aa8e2139dcacdd8282ad6f13ec89e817e782b047

SHA256
4bd94c40eaa2ddc69b64c0e1e13f5365c1778513f5ecb188be29ae3ee2f034ff

SHA512
6cda4d732b8625e39213e41b08f232b8d4e46fb195758af618d721dfd8d94446e705b203c434d970e99f8d8a0f2da2615d5924abbcaf1b2153d38c72a0b730d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829ff8cc4685e735ad0381241fc889f1

SHA1
ed70bcedca3a2406eb03487695eb4d8a61f90323

SHA256
d529fe1c72929fc61c58ebe1bb5b1ad70def45ed9729c3f298c2d7ac0148e1b4

SHA512
8be9222ebea14f1c645e389e33fe85bfd4ecf0322675970ca68a458814ef1820b52078e7b3c2c7a814ba17f203c274dc50a51a16d134a1fec530b4bbbfe2de14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c9c98ff495dba7c0f5985e0f44e9be

SHA1
14d9ba5bab21626fcbb36ff0bcd6268647d28d0b

SHA256
f6d9aec992337f34399a6076ce356005b42e77a1e2ec7dde3b3dbffaabe24b92

SHA512
6bf171120ca29f94b9c0f014de447fda77484f63f9c18a0fde2b72654911edf032e4c9563c1e771681deb7cd99541a21ae2f79b9cc0655cf951b27854a3811de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c965f96461a3bc8836a3b8dd373901

SHA1
4258afb41211611fb67863753c5042e1c5700214

SHA256
e5b398fb88b07c84bc1d94208e609cf585b7a0453193e7112dd07751c4cef203

SHA512
1387c5bcbe990e65b5ee82ce30b69872f4beb2b1925fd7cb4805e368ac6e08ab0e59abf5bed198d85a55e31839c5631193055532d98b0eb5e337be5805d901b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f451cfba3fbb160e482b01aee924eaf

SHA1
fcb1d8b128377d084f9d93920202979509d36338

SHA256
13a1d7c0bca785d5b1c3684a87fe4ccc83c53ebc6186ea7cfcbcab13d6e11264

SHA512
af773079f4bc055c7531db45bc3691360c131c005187903cff63ec271818d62c78a605fd17ca74a2e30392795782cf32591bc33da0c3831b2c85fef724dbce71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e242964f5d2f6fa06ea9cdc60a1dc594

SHA1
a496d727acde3b8c8ac189b8fead325a38b674a2

SHA256
9471a658e830a9b223878c7225fad5370e4dc6da62e31f61a9548c0ce0044fec

SHA512
b554baa04e1f03be0cf8fff2c66c8adf6607d294ec974158ab7d899ddf0860ca63e8f0cb00ce9deea1e57572a4a696da227bb343cbe90b3e714c13e410c6046e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da188a2440118ef5474944d0ee75a253

SHA1
8cc84cdf233232fded7db5b026138249c9efac61

SHA256
4c28237621d21e119501242651aed2f6229beacd1df8a8d1076b99e9f3691f72

SHA512
f7b8ba9e9e1713ebf1e46a2b78af9f0130ae13a62b67e70a110a5c614df9578e324c7e257891afd54030840af063405c1b276c1a6b8b0a729620628fcca29d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ef7c9090af4be00a9130efcf73e1ef

SHA1
f479ce96496ca362d1b9ebcd3433167bd0c65a51

SHA256
39dd348139140d12ee6cb6cf8629dd1d76a1b938cfa4362d4eb0787ce9ae6f47

SHA512
1b6b29d360cc23b7311b0493730207bb31ae308f9663760bdb71e65aa24068f36f073d4437f94868e10e47c2d94380460230ffcfa82e832c172294aa6b605efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGZY45B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab566C.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5952.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0D32VORF.txt

Filesize
608B

MD5
4cc8d4bf17755b32960a2aa95e78ed8c

SHA1
aa94fb7e20f9d039c11e3eee93821ae96df194cb

SHA256
1dc6bb030def627e6f85f4bc794d7cd3cf253327c3630618e64b6f632b945667

SHA512
f94d47575dcccbb591e63af37dfd2ed53f6c59a9f7b024cacdf31c7e90aa4a24545bd62f73286c6b549cb3e666b1d124aecc482d328b582a143ef1dfa5d4befe

Download Submit