34b25843d49f4bb82586e0ed094b4c1e4496537746766a095fd9c67ed2f4f43d

Analysis

max time kernel
100s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pom.xml
Size

4KB
MD5

90513a6b4e100769dabc10a23fdc05e8
SHA1

be7d2264e91804540f8d1d6e6bfdde2b01ed5bcd
SHA256

65be233062775d8b6ab1aef57cb33f966d002376099cd40d82e6f1991012e1da
SHA512

534cc4b44aa94640f3e2aa94e4e9bd9d9b850aabee2e4495be3f6dcf82c7474ae62431c58a547ad6ec397b32a99842326601fbbd8a5d031dfbe79b7e9c9de02d
SSDEEP

96:nHMs8YV9RC37X7fic2ECLM1tPMCMON1XMA:ss8YV9MrX7fiNECLM1tPM1ON1N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392976648"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04fed67e099d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{915502D1-05D3-11EE-B56E-E6D401764DCF} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000034dc23278c0e0b4689945b8856499ad500000000020000000000106600000001000020000000000d207d08d25ffbc57a62699e35e574336f05cce658dd195ff0dc1ade50f861000000000e8000000002000020000000e5fccee05816db6905cb722d12efbef92d43a7d2352a20bbe45d19e7eba6df7b900000004182a3020745039174b238711c5e670706eb7bcf572f49b9be2165dc8aed05caf37e3d8ecee1dbce6f2b39718eac50c2744d28ecff9a9956635897cf289993ce2fe1f2a37e7c2a2c37294d068b7741c8c69070848e6983833f58b21013bf74c883c79f2c1e69ffff61277786d53b9d110b7be2a5a02ae45170be57dd3fbf17c60d39f00192e8a331923f7fa9751e9df8400000004b36d5afcb9364005034a45f8bec9b8e6ded5baac457b486a6baffd59cb722cec6652b8009d8ee2bfe94c31cdcdf1ee8345209287b363bbd3560435ce36c26c4	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000034dc23278c0e0b4689945b8856499ad5000000000200000000001066000000010000200000004227f102728acc977a61530d4527c4aa1798967a55121ac6236dcef3d38e2db3000000000e800000000200002000000009cdaae67e2fbe55d88fdaa0026d4f8bbeb7a66bad3477b7fe732f748251da2b20000000c647a12c90df9e40c1bc53c30054609e23da08e90962b5d9e04ae5aac1951c0140000000ee9ce78d7c598f9892c016af6b2ec735c079ed33528bf5313be0dafee9d22076124b2a2496e41ba803f99ab4cbf66b9ed526bf5c07693e05504abf570038539a	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
580	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
580	IEXPLORE.EXE
580	IEXPLORE.EXE
1080	IEXPLORE.EXE
1080	IEXPLORE.EXE
1080	IEXPLORE.EXE
1080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 588	1460	MSOXMLED.EXE	28
PID 1460 wrote to memory of 588	1460	MSOXMLED.EXE	28
PID 1460 wrote to memory of 588	1460	MSOXMLED.EXE	28
PID 1460 wrote to memory of 588	1460	MSOXMLED.EXE	28
PID 588 wrote to memory of 580	588	iexplore.exe	29
PID 588 wrote to memory of 580	588	iexplore.exe	29
PID 588 wrote to memory of 580	588	iexplore.exe	29
PID 588 wrote to memory of 580	588	iexplore.exe	29
PID 580 wrote to memory of 1080	580	IEXPLORE.EXE	30
PID 580 wrote to memory of 1080	580	IEXPLORE.EXE	30
PID 580 wrote to memory of 1080	580	IEXPLORE.EXE	30
PID 580 wrote to memory of 1080	580	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\pom.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a003768508435ab275d1aa495b8b157f

SHA1
51b8b4ffbcbada5f42952ebacbc2cc579d171e29

SHA256
c7b8b7d0cddca8bfd65c50ee0735c9df8e91b601366450d9a7e86c1ca97c190a

SHA512
5aa96e2acbe31b4c52f1b3a4a6c095600aa5340ed4c1f11095f3305690991a2e325dba7354ba7a6f62f68c2c77ffb83ad158b57fcdd59125a3d9f4c46d796d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79d1db4ef05f5d1188d2840d3623e6e7

SHA1
3c690e4f2c76ae8f5af6a71b4320044245e7859d

SHA256
763b685e5e3b20143d7dd8e589d94b308745c9badcf9cf780be8c0574b2f73c2

SHA512
8b1dd3e1e07fc105b3f59a0decd12786b5ea1d2c9dfdcd4cb4e2f947a0391d0479efa9f659ee6f0c33314d832dfbb3881510e4642048c2398777c7d868dfa0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b48d48178eadf2d38e44de58ac831cf

SHA1
9c97089f5d9d31e72aada01ae328d0969d38771a

SHA256
d7d9bf414a34695a17918c902621d4d5dc88d5beb31bb89da001c56b95785362

SHA512
2b7f70eab1c27f9b23d18de3022af5f8d17025b101d3ad9d199001ef1130bad01a1fb411115cc2b3f54fa2d984ef66496e06f94bf327486e705260e4315ae760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92c8e9169fb6ce9e8541824007c73f7b

SHA1
cfc6f942e988dd7bc8a3471aa5ee1fe8c9494bd7

SHA256
8cb298b165a86477b4e2bb6899cebd4f95c07600e81160da6d1b454741520ac2

SHA512
05ca3316498ebda669543c16c4a7831ac3920cd43fd4ebfb3d7e84f272e86619409e8f9480945375dcd197e081c1c033f58a6614616db10ffba8a14a9c33ed03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b15c1d6e78f0de603f0fccd0b8fa12

SHA1
64e9420fc9895965e7bf25b1229857b99587c0ec

SHA256
3bb3d523939f09c927b7ce09c091f7f50b2c94a0d5753c15eca594bd39aa12ca

SHA512
b2683be52e2ed1110e6078ce4912f2d17d5c42ad23e40a2d26462dd30edcc22e6564bdc1a7efa41bc159d8f963bbb9fc545d4ef72a5f865851452afb9450239f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84010fb5c56b79d17a3e9a34768cda1a

SHA1
509ed5135ae8eca41d6b61e89e3fd7d6d976a24e

SHA256
2c1b9adcac50e8ab482f1d2415b9b4651719ab067d9fe26528f0dcd3b762aca3

SHA512
01e9bd2d61a6382f077ca738bde64de64cc9e331ee6958f9b4fe7c11b074ff5083cdb91e89f16403c45a51604c69131d91ac395e1d2587999380bb01bba34809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf89735cc5d0c6958620a96abcbc519

SHA1
ecdd935e8ef378eaa3210d8cd60d37b260580a06

SHA256
cb657b13cf7465ba80e8ab6c798cc7a1f074def586e9b35fc47c9fe72541db2f

SHA512
18918d4e683df03883d5a4503cb9d81094ab907d174095f074db73c407630320f5d270a0fff3dcca63136fd4f24ba28017563bc7032272cd1880653d4b3a4487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8fe42679f880ed1375e8107ed386ad

SHA1
7335423f416bf41ffaa7b759eafb62e7c6b48e74

SHA256
5c31c60f5fcd6f8d815e7609277758c60b7162a6f369d315b1f28b890c313b07

SHA512
b7433d30164e1c199094711c8bbba2e07d336818c9f3ae0dcdf9d75cf9e000109b9dbf8e4f2f228982ad5561021d030087176503778f9866b7df6f74f20e9155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7247.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar752B.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TPL210FC.txt

Filesize
607B

MD5
b0191ab7a019da6ec2ab5e9b0c8a7259

SHA1
5ce7e694967ffd53c789ea883d4dd0b0356ff161

SHA256
e8e935416e9975e36a0b3c8c87efcb7ef2a2a9ef237d9c0d61b845407188c115

SHA512
65ec421ab873ba36731d77282f4acc3e0397a596ef5408105d44deb025e61dbfedd2effb1bb34ab5d5638bb0be5b4a83d8fce14483e669cf4ef6b3e37025df59

Download Submit