4ba393807036fa63f4a84d7bb9a019ca0efbaedf5f901c71ea2f9b2db0d3def1

Resubmissions

15-06-2023 09:53

230615-lw5tvsfg54 10

25-05-2023 01:24

230525-bsr4gsff42 10

Analysis

max time kernel
101s
max time network
141s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-05-2023 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_05.xml
Size

471B
MD5

d088bfa4b1e206c8c5ed88405855f767
SHA1

1cc0925ff6a38384f466560cc86b1afcadbeb15c
SHA256

2f7924e1f2537622b8617a051765bd4fe57272e9f14a37f4bbe127269c522434
SHA512

d1ceda7c098a5934f1808d9b89bcb7fa8809a1f084e915ea0c12ee9070b854ae9d625eaccee3af3db5d50a07438eeb346b01ea73463fe5e34b988a7663321b79

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F30FA5F1-FA9A-11ED-AA6F-4E1AE6AC1D45} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000559f4504f8af714aa118952e6d60c11d00000000020000000000106600000001000020000000841c92109008fa87edc33d3d6990ba5d989c59f780dbcf18941bde8421b43bb7000000000e8000000002000020000000f341bc0372a19c630ed1e3fd0005e4e617b2c8668900ab61d71658e4b72e0e492000000019aafcdb8c36d06fdcfba9844e81bab34575715dd76e11f72829e10ebdcacb23400000006f7538353b93cf4c5aeead3477e77e9240daa61ae72c1db7c08aa593ff8633eff8af9d1173ef069d63baf1b026b5739105850d95959b39842b661d6684ebab5e	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000559f4504f8af714aa118952e6d60c11d00000000020000000000106600000001000020000000988348991a215052f2b1fadbd946d49d3910a528ce7ad613db5ecbff0e225d9c000000000e800000000200002000000024089454b9558f5363fe068a3f442aa2cf5feee29e5c5aa72cc0bd43591322319000000032ad6ee2d62a89bf991c70b6ea6b76c8b6652802a51feb759c4f8a58a7810cfdeab81300a1e9ccb8209997c3e7361f15fad80cfcccb8cfc392b91fda886f530ff91680b783eebf53679dbc6f5694076b186c555b1fef9dbb025cbb16c033862e226057c3f00ae2abd31a861fc7af8faad8049e6e1ab12af1471cec381af7c29ae04b0669937137984299f3d464513a6740000000fcf48ac25ed3fb0c9ef19d7f1c5277c9fef12aa6ceaf5a8b53d6dfa143990f6e6c29c0f34a6404479ee3fa758fb9285f63b636d91f7b8a6f9b0d63f2236f5557	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391742868"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b9f5c8a78ed901	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid	Process
620	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid	Process
620	IEXPLORE.EXE
620	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	Process	procid_target
PID 1048 wrote to memory of 1460	1048	MSOXMLED.EXE	27
PID 1048 wrote to memory of 1460	1048	MSOXMLED.EXE	27
PID 1048 wrote to memory of 1460	1048	MSOXMLED.EXE	27
PID 1048 wrote to memory of 1460	1048	MSOXMLED.EXE	27
PID 1460 wrote to memory of 620	1460	iexplore.exe	28
PID 1460 wrote to memory of 620	1460	iexplore.exe	28
PID 1460 wrote to memory of 620	1460	iexplore.exe	28
PID 1460 wrote to memory of 620	1460	iexplore.exe	28
PID 620 wrote to memory of 760	620	IEXPLORE.EXE	29
PID 620 wrote to memory of 760	620	IEXPLORE.EXE	29
PID 620 wrote to memory of 760	620	IEXPLORE.EXE	29
PID 620 wrote to memory of 760	620	IEXPLORE.EXE	29

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_05.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f30ab06c555075768d9c44bf1e94d4ba

SHA1
8a58917cda01eed558dcceabb09861567c9623f4

SHA256
a8c8520eb2135f33fbf79354de6ab9b35262a3d44b181ae60c6c1a1ed2320133

SHA512
1c131067dcb029d96aa9bbda13f2707ae24c6349c2ff99172d2efcb13ba87a97e1a4fbd3685b0dc92280b2974565858367d6c26a595e1f58dbe1e631676ee58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41aa26cea797136968bdf6e8647813fb

SHA1
a9a49b416621e087210a8c8fdfaad18e6b6f7b43

SHA256
86c3d26b3e59ac4d295b2029c700b8e3d21814d656c137153b3abe623d884eb0

SHA512
74c72a3f712976af4c7e803189e39972125f33aabe359bad8040386a1c6ed9a47c67c5dbd4e6694cebebad9ee75fc6063145a4c05bb7be281113f4d62828d577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28ba7a4e4f8bdc775c219264abcb0d8

SHA1
ef944dd81da08b225d84334679f87d17dd07cf6b

SHA256
8183a626e39b121158a0650ea41642af464acab08ec06a60a314e8f5d1f771b9

SHA512
f393a953f3987f5784c24a989f4763923bbcc41339db37cbffc1da5b5ac9401f4aa33e3a48a4d33eb640d0e427b664f0aef8c4d3bc82475e37faaf8460b83dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42abf8e9a469dafe8d7586abc5109fd0

SHA1
0c17494b9fcc72e941570bab6b3b65718a45a071

SHA256
59c2093db6f464bfc071b5a30cc739fb32b29371c367d6e324889a78b263c82c

SHA512
92d6b8af1b0e997312f3820638821b2e8a3ba755b772178756cd36182eae5a41603131aeecb3db2d796308ba2950b5c20b5efa885a29fdf99c1b0e7186d91905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fdb456d9cb645fbc50bc395218897b4

SHA1
1233f88fc6a799f0be4e0ee2479182e2231172c8

SHA256
516154b97c6dea84bb0b1c1974a83784f4cda9d62d031d1491beee7dd3c255fd

SHA512
c7c3fdc22eef7b741e10520f036c260ff90b09acd24f0bee27dd4823f61c860b142104447f50a8f523393acb05f8dfb7e907dcf37a2db6423d2a278a1eb37787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2ab960f792402080e0e99416bb865d8

SHA1
6889d777c3d4ba3e26d2ca112bdd6dcd25422575

SHA256
55d0163d9901de31548e19780f14cebc5b4cb22c9b43c24170fe4a92b9d89ccd

SHA512
e11d890fac81a2f8cad96d4eecacccabd50cbc56aaa88cf6f2a700fb2cc758cb07e5e88b7f3f7ec7db8a9877f0cc1acc62c21d3209d190388b47bdb150c03c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264b4b02a07399b78bf1b4f587dbfd71

SHA1
f64cf9f44524791e668680531f3a0bad3658eecb

SHA256
0bce1e889b1399366f4a93cf84bd26cb5519975eb893b02218ed3f000da54175

SHA512
1fe4928e026e5dc04721dcd770aea757bb5a3e4b16b505b5944f878ce7810ce277574321c5e84e64d20802ffc9d60495d200d9b4b0eb1d7f27f8219870b347ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB82B.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB96C.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZDE8OFY0.txt

Filesize
608B

MD5
5da75bb23ea55a98120f6c47f95663ed

SHA1
8f450938f91a01c34230f328b1c0dbbe5fa0263c

SHA256
7c573c5e75163927dca8cdb3da4b1978e1e3dba93b976ddd63a016368d6f9eb2

SHA512
b0dd4afb6fb1f856440708585f64d5e0b5c35f4342803ea18a6e4e912e350852ddd1e146640f8ace1423b4114af279f8f169ae9c70a9141b5eee7f4501b168ff

Download Submit