4ba393807036fa63f4a84d7bb9a019ca0efbaedf5f901c71ea2f9b2db0d3def1

Resubmissions

15-06-2023 09:53

230615-lw5tvsfg54 10

25-05-2023 01:24

230525-bsr4gsff42 10

Analysis

max time kernel
100s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-05-2023 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_09.xml
Size

768B
MD5

d27d23e513bd38323c5d0d2330ef3dcf
SHA1

4a25cabf4c9c56d2bd2c3c900d412794a01f67c8
SHA256

f50fe6ce471e0fed4114baef0576045b742c49bdd4b611c543e42521db5f2822
SHA512

3780e6b964cb462594166c2cea602a5473f83567f4cd09a94070499b700a8ef355392f5286bb9ace3b22fe7c066cac5ec4c47e287254cae329fc9accee488d64

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dec8537f7db05e49afbfd001ab0561f400000000020000000000106600000001000020000000f131717099ed371a759c7752418e398f87a8660514571d8ceb025d8da95794dd000000000e800000000200002000000057bee85ae7bc1a1502e94474d393a56a5ecb0791a4c7a18df919008d0c852a739000000095a7cd4d357e355bf17f22820646f11c4a584caf852f7047b5ca4a061dc69d159552e1041769b61bf560dc2eb1c83cace2f069cd990b22ca82784d0452a1d92df582d60cac0f04c04d26a914d38a8ba04b0fe13d7403c4b3a56eb110ed25512f2cbb6e9a6edd21ca0d274f7441e3fa842e84f2d45ea77b2ce7a0252265d642e15ddbfa866202807d2fdaf9ba01d40cec400000005769d606d674809089d91f0114897ea8c346ed2a4657f3ea3d2ca78feefbc95cc7d800ed6b05e9a36abd89e0ab42a6f3edacdb5cd20ca188eef1f92150e2bfae	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9089ed8ab88ed901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391750066"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5514051-FAAB-11ED-9047-DE010D53120A} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dec8537f7db05e49afbfd001ab0561f4000000000200000000001066000000010000200000007211af030ab8b54ea004b1a24e407f5f11e5ae30eb6d7eb88c490a5dee72b002000000000e8000000002000020000000a410ffb57215500366993d157ab5a97f59c25de6028b50947075c5373ce1f83e20000000ba35fd899a4058a399be90eacdeacd736dbaf43a2a87f3988e347a18b993f1ca40000000bde0c5ad52e2da1f96ad859b66309b65608138d22d60a36089254c981d7ff24998480ac6b3a46f11dd15e2d11f386a3a5318295c0f983cfd73b7e941e98f0c3b	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

588 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

588 IEXPLORE.EXE
588 IEXPLORE.EXE
880 IEXPLORE.EXE
880 IEXPLORE.EXE
880 IEXPLORE.EXE
880 IEXPLORE.EXE

pid	process
588	IEXPLORE.EXE

pid	process
588	IEXPLORE.EXE
588	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1416 wrote to memory of 296	1416	MSOXMLED.EXE	iexplore.exe
PID 1416 wrote to memory of 296	1416	MSOXMLED.EXE	iexplore.exe
PID 1416 wrote to memory of 296	1416	MSOXMLED.EXE	iexplore.exe
PID 1416 wrote to memory of 296	1416	MSOXMLED.EXE	iexplore.exe
PID 296 wrote to memory of 588	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 588	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 588	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 588	296	iexplore.exe	IEXPLORE.EXE
PID 588 wrote to memory of 880	588	IEXPLORE.EXE	IEXPLORE.EXE
PID 588 wrote to memory of 880	588	IEXPLORE.EXE	IEXPLORE.EXE
PID 588 wrote to memory of 880	588	IEXPLORE.EXE	IEXPLORE.EXE
PID 588 wrote to memory of 880	588	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_09.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fd0915da6c80dfaabeab5c01ba7a9f7

SHA1
089816e6d2e5274b780776890fffb5f86af4a7cd

SHA256
d37bb51cbc47fe2adec2ac78cad53a6eeed99f1c38ef7c56e294026f0c97ee28

SHA512
11942ee63dadfe2f716a8b2306fd5ac76aa9c23d9a1fad345bb35d1b695b6f120095c7c4db65c04ed683db43edab0d7cedb3e0973e6907cb682d4077d474ffa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45864038ab87755c16aa936fed7aae7b

SHA1
0d3e72e3c87294e3930049cb5d5a593c52952187

SHA256
d63941afe7a792568be7eb605a340d08d5dc7be1eceea8a95ab1c105b4e14d18

SHA512
ea28c6282e27075267116106c62ac36c1f854f9c48da67b8f570e8dca226a0849aeb321721fb15325d4f47a8b819b143d22ddd1dedb561f8a66ce8e1af97d83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f260cb2e54d18255c6203fd7ebdd4e

SHA1
5774cd0182bbfa4b6bc607e07f7c83720bd09a38

SHA256
9ec9541c1e018ecbed5a276350e4b19cc77bcc8f0ed88b1f8dc608a2aceb7347

SHA512
24ab128e94439228a72d0df5ba0f40e3cb38dd412408fe362c1935d88a5ea5f41fbd4e6c7c3c09fd0ad1c01baf2ee16118b1e5edab4fc07aab5775d2aebad57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0a55640ade2b544cc5ec96acb20d0f9

SHA1
660f591ec2c6470b80b296738577c94e36597c14

SHA256
61e370c4f2c772777eb36f40021f929b6eb88517d64a07b58ff12ade4cbd040d

SHA512
62a6d17afea86d34a241d5a299bc7ddd3e4dd41b116ba375d16ee8390f0cd7fbd75ba671162998945c1d2e9bac435c43019020129cf3e7f641eac7bf10d566c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd357804c728ced7967fffc38b64930

SHA1
b4603c4349ec93f3e23feb803e5753491cfd37f6

SHA256
450da24bbea5b1ec1e20038bd4dee32a80574701e0f6564c994a9c98cbee5c5b

SHA512
5330ac8067cf1459bfdcdd7309de90eb38c208445444246a96c521346cbf055dbe5ffc7f6289d45a38f7ec12ef32663e8bd561c4d231e3734485933fd797a955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d17bb76d05a1b5a14add313963755c7d

SHA1
dba38ae6d7ad182235304ddcf7bdd7c1a6e220bd

SHA256
9b3261a1e2bb46037f9169295cccf7d0c48c6a43a647d924e4ba6c7cf9ea6d64

SHA512
c2b483c125b3ca01187cb474e030023dd050582e6dad597db59a45199847a0240ebe510ae2a9e9190368d60e5d89c1268725b11fb1e93996f1c442db4dda1877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7ebb7de5c6e223a4471d38fd0728255

SHA1
e73f2c2667a51688fb62571c6d87ee0e3cddc0ea

SHA256
48d180b1842b218e4e2dcac30f111803523d07f8545cfdb27de9d278b966c1e0

SHA512
bed1b50a53a2a16ecb16bac2bf7edc71b46611535a18202288b2edc02a75bdb92d451f6a3ff800a55a7dc83e3f1c6d9b8e3c7a10354e135b8a53d9f0cb6ac2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a7e805d35e86bb4790eafc69763ab1f

SHA1
323fb624a5a0dc6f514c097ee54a7a22e53d8e6b

SHA256
9d4c4ba895bb2f28222a916da27ec68a95911d7a8fc674f445b096ad565b7290

SHA512
0229606d44ee4b6613dd9f420319686fd9641f9c13afbefec85348046b03c760ce02a3d635fe2b064372925703e620811dd062f7024588f10730c62995281b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028a7b2cb8228fa4afc0039a4654ad37

SHA1
0f889f6ffa36c68a1a85d2c2953289b92d266a2c

SHA256
a426e41fdff157c0f23efe4916ebe11424d7e682805465892cc070e76d96212d

SHA512
415b1179ee510717ecfa3736d63973c1d3b0f252b75c4ca343f7cbd4a040ac67a945f8b629c8b6fb3dabd88341dd167b587b5525afde0d1b330e1c6b4a26efbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3778.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XJW1MROI.txt

Filesize
606B

MD5
beaa5afe7ca2af2d06854e7697b44662

SHA1
537e293e5ea7b9c943920f409de69c7a6c03afc8

SHA256
b6d60d5ffb5fbc55e934355fb6f9b8c112f2eb1db98551737bbc22da61647a1d

SHA512
06d86a8bc12cbf1dfb166bfc0d4467bb85f825fbd095a462c7ed5fc25240d372cc84680bb671b6d58a91167c30224bdc2f7b2380ebcb633572c0e763ad44d9f8

Download Submit