adf2482b7b36c11826486065f9551ca69742dbd70915acc1b2d740862fdcd106

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boost_01_effect.xml
Size

2KB
MD5

c638bc6f61497a4a2c32f62af4bd60fe
SHA1

3618e84825c6b5fa6d0d63d3e8dacca90c490fff
SHA256

d3d9dcc6da6b954049e8834661f6d2a1d3f7256928991fe08f49c5daa62a8637
SHA512

814470fac0d683a3019f004a4e0d98420c0a72dcd51dbddefbf496b7a90e25b6e8663279240ef0c2e17f141571ee923271a0e1b2ac3ca1bce2fdb46398720dd8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce6c1fd590d67549b08121d018d2c669000000000200000000001066000000010000200000005de634717eb38c635f0b73c97e3162a87d4ae84c093d5bddb81da3be1cfc1b91000000000e8000000002000020000000851f674730cb87f5b98b6f1d016fc512aeb1a2a22d1404288a25f4e11860932c200000008cbf3dd5edda3f6a18250a424141489534a8d5f17f243c9ad7361045f564be8840000000443e2e5ec138e9e540ac3660097b7c3931c731d4aacdb9647e85531eea3e99135a4f46ca9ee078b99b8b45c71b54e544d0979a3b3673b28ea5158ca2b4c17f9e	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393202279"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce6c1fd590d67549b08121d018d2c66900000000020000000000106600000001000020000000d51f1d3e05946396b271bd3008163643a5a43f6086aa8c8384ebc98789587f3d000000000e800000000200002000000015f6fa6e86034bd8df0480df4b8c84b277ddd356568834bef60175bcdfbdc17290000000997779c920a7083209124d13fa862bc0ec73c3365c22cbe403f376c2eb4b9487fcf668ec49563f60426b76a96feb890f6e86989267e3590f44b1df0e255a55c44bc6f21340e28cc1909cf4b6bb78b8fad41b571b30606334af3c48b3a4cd744a13a4dc9103e77c0f2d8abeb9cefad90f4d0ca3d01cea36289a70993ae2290179af8fdbef69bd7c3596967b08cd09cfc34000000011def8a076c07a1800a9ce14872d506bf95153d15590fdf6e3e7d551f4a3bc8b0760593a4c58871a351291436c8f7bbc951a26b229ea4416c88b6168aa1e78d4	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a7f1bfed9bd901	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7D76DA1-07E0-11EE-9C7A-7AA90D5E5B0D} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

676 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

676 IEXPLORE.EXE
676 IEXPLORE.EXE
528 IEXPLORE.EXE
528 IEXPLORE.EXE
528 IEXPLORE.EXE
528 IEXPLORE.EXE

pid	process
676	IEXPLORE.EXE

pid	process
676	IEXPLORE.EXE
676	IEXPLORE.EXE
528	IEXPLORE.EXE
528	IEXPLORE.EXE
528	IEXPLORE.EXE
528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1704 wrote to memory of 540	1704	MSOXMLED.EXE	iexplore.exe
PID 1704 wrote to memory of 540	1704	MSOXMLED.EXE	iexplore.exe
PID 1704 wrote to memory of 540	1704	MSOXMLED.EXE	iexplore.exe
PID 1704 wrote to memory of 540	1704	MSOXMLED.EXE	iexplore.exe
PID 540 wrote to memory of 676	540	iexplore.exe	IEXPLORE.EXE
PID 540 wrote to memory of 676	540	iexplore.exe	IEXPLORE.EXE
PID 540 wrote to memory of 676	540	iexplore.exe	IEXPLORE.EXE
PID 540 wrote to memory of 676	540	iexplore.exe	IEXPLORE.EXE
PID 676 wrote to memory of 528	676	IEXPLORE.EXE	IEXPLORE.EXE
PID 676 wrote to memory of 528	676	IEXPLORE.EXE	IEXPLORE.EXE
PID 676 wrote to memory of 528	676	IEXPLORE.EXE	IEXPLORE.EXE
PID 676 wrote to memory of 528	676	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\boost_01_effect.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:676 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8cbae69ccc2c9a78c4698c7769fcb882

SHA1
986c1a7eddca7bf4460fc3557d5844fea3688350

SHA256
729e99046a49685b636ddc5018eceddee252436f28256dc93a6e6b478b19b16f

SHA512
2c4197ac06ba6cf2d68a9ac8f86a7699a55395f946f74d222ebbf8b80a2f95a607af3ae0972977dae5cf32e5ecead9fdf6fb1623d0697af5f6de90cb02e41051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
caafd44f1678ae4ec222f3b75c16e994

SHA1
385b9842b8526a910f22fccac59e1bd4016090b3

SHA256
bddb3c9f601f83444f863d9de076cbcc17d9f5c70c37658686042ce26c14311a

SHA512
4b00e3d6d6a88e8f63f0ae3c710e6fd1c82c11fecd70ba2fa067461e6eb1f439ae761138e7d19f691ab5935ccc999d64145eed7d9a540f6acd0c05d6d208d6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
251b13a14c01116aefb853de6675d8bc

SHA1
68b3c9dac2fc743fec057812d4d4e27283a2e571

SHA256
6a7e425817207cdc4af32c848826b7d7e8a47fd9cce4ac5d91acb3721b2f3d8e

SHA512
38f03d93612ea679f892c533349ed44551094db8b1d5a5ca6e62dc3448688b5a925fbcecc92f0ba19668297dab1ee3b02374e431040a406df8f107465a36b376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
583b543db1f02581114b04f2055e45aa

SHA1
de5c1dc609fd759df13784378431fec562f2bea7

SHA256
388a8bd1108f6a9efbf18ece7bd5735e372c972b906f54e04eb9b12bf5103574

SHA512
8493aa7c62d3d36290b677e461391fe369ab2135b58126392c8db61054303f9d3f6b03d5b3ecf96a863ca973da7c2dab44813ac4d9a00ac14b39468723ce370f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0600cd886061879e52ee9b4d1cf4d823

SHA1
583504e17db416878e3b286b369b69f7531fe8db

SHA256
1b170bf9586be154c3141bf964be97495e609b1bbef5e6b49fc08bb3dfdad4d9

SHA512
b0cb45fa965a138ff533909a2231b7565db2f52e59a283554d68a68aed4299db592bdfa208cb68af05270578de91583e6414cca3cbc6ffde0811d7a132d946d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cd1d277d87a6ad326227bda253389bb5

SHA1
d82e90c780d33bca21a8a8c1147ddc53303b1fe9

SHA256
e05bfced8163de18481499528db2eb6994fcd6ea2d9d78177d387837c21d3138

SHA512
d83ad08ed9fc7df7c210b7a3e5c30542337115dcc149351b84c1a883f9dce07c0ebe6d93f7be0bcb85a37a76889666fd43ce2a68e480a3a68f14077fbaa788e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE3B.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEDB.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF6D.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8UFE8PF3.txt
Filesize
608B

MD5
47f7780472ffda86894fa8e6ec8d316b

SHA1
572a5eb9933d337a1ebe66b833a7f2d767890acb

SHA256
a610af174298f249601c3afadff1a63c3ca45eb6adcd27b5ad5d99a985eadde7

SHA512
8091a32077016d7b6d108181765b2897bf875d26ce4954a993c62f90748eadcc4d063839ba1d419ed5308067bf2eff012750cb123c380998494686108cbf2260

Download Submit