e1da5cd02d74bb5ba944e3ce44037860ac9f42392eec6c99b9543910e1a3a5fe

Analysis

max time kernel
100s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cleardot.gif
Size

43B
MD5

ebd4c7248ac9be0c41d02060e3430a5d
SHA1

eabc59bee6a7ff007a1dfc3da3b5493143c0d087
SHA256

e1da5cd02d74bb5ba944e3ce44037860ac9f42392eec6c99b9543910e1a3a5fe
SHA512

0f3b6529892aff05bbddc7614faca83f3651f4b14c107853d2cd502391c35f5e26a41af31b5503d68c77264cda24f616aa9f9655fe8a79e975090365ac38ea71

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0088e6cc0593d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F587B6D1-FEF8-11ED-A3B5-52C255710AF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392223050"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d550ed2b24fcc48b8bdf3c8542e653e0000000002000000000010660000000100002000000025212c124528e2f47e4113a6f16d4419e86c4aa3d112e3e94be72b546f173fb0000000000e8000000002000020000000a806a3741cfa7b9c5e5c3e279bb1af71f2201cb845a1706130795d9a5c0245ee2000000091f44b6d915e1e4e6c3dc1f907ca9fd61e7240fde28179fedebf278b2f03e60540000000b8426a186b9406a214fc32d5fbc9e0360d09edecb2bc861bf8ac793d0b4bb28968a4957414836147524865f858ffe24ae1570320a66f22b600eae959e932f813	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d550ed2b24fcc48b8bdf3c8542e653e00000000020000000000106600000001000020000000a64a13236b8aa7bc6dfae5dbba2b37abaa40b0eff2f59d0292704b42519e34eb000000000e800000000200002000000054787d641f4901735bff3a4ce0fab3dc99067d6a96e54dfebf679703ea61c4209000000013dd3b7526b1a252bfad5e349fafcd2ff72ba38476c68563496f2911d4b9cccd07b0e23003c770d011c15ce747cc22be078a8db08f3e0cbe98af2d69e7c8375a04f629c41425006fb0a61aa214b403c1e8d34f7182655110b459ca521e4ea57d2dc90fea6c5018e62b5216b35d8b7b786ab3bfa02a75772ad4e46af93c86069aa0ca7aa0c57b1382f000d741b7a3ef22400000004b66ca8c44fa07eaf76f5e7f6fa7486be49a94b1eea22eb152af8b383a809a5c066ce00338470d9b783484383723709ca7aa0a6a4f3632e983969eb176ed62ad	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 980	2000	iexplore.exe	29
PID 2000 wrote to memory of 980	2000	iexplore.exe	29
PID 2000 wrote to memory of 980	2000	iexplore.exe	29
PID 2000 wrote to memory of 980	2000	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cleardot.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93bfa0ffa490227be939dfea079be6ee

SHA1
46f9d2112e426a4868ad0e237a6a083c714a9f29

SHA256
450b12120b894751ce7fee6a13ef6b2db12f976b20549f664d0793b66158fbf7

SHA512
423747b7c248742bc5baf61d5fd8c71b27d360063fbee0277ec6988955b9ebc565e78f879fe99da5269bd4c2bcb7b70625fcc170da388753494b1fecc103cad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bc7b70ae649897282535c4caf59aed1

SHA1
a5bba47da6122b12fd56381061d7ed42e9214cd8

SHA256
1eff1ac3e586ef708b1604b3256eb197949e1142498fcf839b9c2fa68f6a1c03

SHA512
0f6fe59ff559e42e31089e7cdfcedac3ae10d0ced3fb142eaec50515593a870fbb851e00940ff5586eda3e9a472f33f8037a7bddb708ba9f8f9a2c278e49b417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a67216cfec89e1dad3e3263750ca054d

SHA1
c4c524c812eae8cdd22461072519056e65a54e47

SHA256
d04461c4ee068d8eebd91bc3c173102ab8ba9d155d33a25f8f2f90955025a0de

SHA512
c843301e847fadf456d4155bd4ed30d8ab90a7b538735bcccaab53960ca63e23af0f9a0e7f5ba136ec32dbbce2b92ec67d35f7ae9d094e7c0ccb91e88dbf9f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a42167cd11239f139a5cf101efa58b4

SHA1
9f778f5945cd56f3c642cbca006e507e25b10dba

SHA256
2c94465e02d1e0745966e928aa58cffb072cf27b56c4e0e0176a81d9d11da955

SHA512
f76259dd42d73e61eeead9d150c1ef4377593d14c4094b01eeb1a99aa372330c145499a4ec83d1e3c79c83f3962a8c3bfa868d992da59770380f0842c1f13ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba1221b35bb0acba05c17d1bfc99e7d

SHA1
2808e0ad62b5933ba79dd106d832a2b345cee350

SHA256
5b347d077afa289d3197525a09102cd1052dcad00a7f758168046f215c8828bf

SHA512
31fdaa089393e0ac1058947bdf778112a8c51032b8b0cfbf2f940afe9acb3d73e53eb71e3664e2bf6e1679ea2709c160f5bf1b8b8efe1ab0dc40e38fe3e7e734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1baadb5e394a4452e5a0cf1a01e20eb

SHA1
04af123053667026ce12ea0f87cb0108f07cf954

SHA256
ba04d9b394b7d7b32f63db20902cdbffe48d2e7b73281edeed9e331ab8c5a924

SHA512
546f998b45ab45439eed8c5e94fb5c1fdc1d79794aca27df133ad31138692628a03489cde1cf807a0184e758178e32e5891fb5b503e4384f311efb2e222f06b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1ff2fd27e71b5938fb926e9b1eea97

SHA1
0471d915611cd4b59e030178cae1fb8b98aafd37

SHA256
5fc87594f377786800d851a8621c6593bc227c859891bbb8af1f1bbdedea32d4

SHA512
ea8876ac3f667c24235d6a5097287f2788848c7c20606d1ac03ab2bf083cbe3829c0311090c6ffa621d2535075a1c2af90a6e1f0b091488b2f35972913d2610f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18205475e2121625c1e31a58704d3328

SHA1
0d0a6583e7aa8800e5f846e3cfd0bea9309fbbd6

SHA256
dc83df74764984790ba2ffa200e00743dbc585082ddeb6a94324a93a1b03fc5f

SHA512
02730c86b19260eadcbf8210e584381c985463ba427175acb969b8fe0ceb476ff31a367c8fb2173437e55b1eacc5533c392b0d339db313c8e22ce262117c3ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabc6353718cb2e06ac99e9e68fb6f03

SHA1
3e7ca9a52c83e3e998a928663cf60e77012ee66b

SHA256
08c10022ef7128f6387838ae36ebee249d8e91f83d432646a9c96821eff1db8a

SHA512
2304d59945fd3a2fe712831dd98feb8caca4d9dde297cb27a2bcdae9ed9ac6c4640f99d26afe136d0e862be7b1e33ca8e28d114821ecdc6a484dc23f09448a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6949d98e7a87e0422cf88e6ca92827b1

SHA1
14b55dbbabb6dff879bbb680e876dcda62dac002

SHA256
eb67860e1b3502bc95d3897ea5c93f1d93bc0f9115ba1959ee2825d5f261d2d0

SHA512
558b011c4db73a8635149b74f6da2c6b2553b4b79b90960f7a81ec3171ad724ec130e685a78262ad215618bcc67b5d0b1c02fb38fb79d3a05633927260d29afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOYUJSME\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A42.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BD1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KQJC116J.txt

Filesize
602B

MD5
4cb3704e69ca16cc52be32a9b3c4fafc

SHA1
3e2eae58dcb80cf1b5551bde7080ee7b0e7ec5be

SHA256
a69576be86b97ec9aecdce5e0ef250d2f3a5de4cc71e0f8bc23740f443310d48

SHA512
dcf23ce3b298d0c39bf695b4d7265ce8c3a30febed62d3ff3103950f4e5a6bec3e2c80266bc463382d4d2ff1a8665540a41d13affda37b9f5706a4c78f3456ae

Download Submit