adf2482b7b36c11826486065f9551ca69742dbd70915acc1b2d740862fdcd106

Analysis

max time kernel
140s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-06-2023 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bubbleEffect.xml
Size

2KB
MD5

92c33af019b971db151ce8c9dc7d157a
SHA1

d08056779fa552e23a3a06ceb957b18e71c4a943
SHA256

90d202a11098cd5dc3c6a55b9c8a5ecdd180db4be90d231b50097263e27f4c16
SHA512

185d431b2952c7a09bf247109194ed144261962615e8821c881b7dc4e1c6cf9fdecc0ed6fb4fcd7e7f32deb702809b8904ff200fd0f2d9f296be4cefb9b67e48

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0149BE1-081F-11EE-BB8F-D6914D53598A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000075ef436851adac48b0cc0faf864f0d7e0000000002000000000010660000000100002000000086840e6744e06d44c3455cac61945a1acf59a9dd8ffc9baee0e5ccf71d5ee504000000000e8000000002000020000000aa61887ffe5e8c7701d219ea07aaac3a83fbca5edf0bd253c6a2f40140bf9df990000000b43efec49a014b471f24f0d8b4562b2d6f0c5c8035428409af504274225d083af5afdc51fdcf9add482540d99ff53e495b64ccb016e5b473dccd0dd181237be7379872e911b0165ca95eaa290c4d9517c7242938516ed732f74fd8b65997139668f1b9bb89e4efa147f565691d38865fbedb57743208c2f4cafc78109fe45fb3751a41eaaf06c5925c35ac9c09636def4000000055c891a69ab4d505f125b9dede77c62c5f5c87455077654b554f17b93587f2a51849b6a381804f25a96a4b49ce67fa9db0d3969664a0221b650c53e28fdf61f6	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e5c0ab2c9cd901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000075ef436851adac48b0cc0faf864f0d7e000000000200000000001066000000010000200000001f766fc13205ef21165cfb381b56bbb0acf27909e7b52470a0dff65e07beea90000000000e8000000002000020000000b31187f7943722e648a9d854dc0ad8570f00092949f9f4ffd6925f2d6bb8016a200000002b21ef95f08ea6b9d0cc7b9f4702b299087bc0d849be2d864cca57d269c3688840000000569545bab9d56f8d109d847fd57d21df97476bf9bf0c80da876adbf7d5be7c0f92dfb2b6e816c2c73c811a73f7e332ed44dee952319c2cea8ad039d6bb2a0d8f	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393229297"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1772 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1772 IEXPLORE.EXE
1772 IEXPLORE.EXE
876 IEXPLORE.EXE
876 IEXPLORE.EXE
876 IEXPLORE.EXE
876 IEXPLORE.EXE

pid	process
1772	IEXPLORE.EXE

pid	process
1772	IEXPLORE.EXE
1772	IEXPLORE.EXE
876	IEXPLORE.EXE
876	IEXPLORE.EXE
876	IEXPLORE.EXE
876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1348 wrote to memory of 436	1348	MSOXMLED.EXE	iexplore.exe
PID 1348 wrote to memory of 436	1348	MSOXMLED.EXE	iexplore.exe
PID 1348 wrote to memory of 436	1348	MSOXMLED.EXE	iexplore.exe
PID 1348 wrote to memory of 436	1348	MSOXMLED.EXE	iexplore.exe
PID 436 wrote to memory of 1772	436	iexplore.exe	IEXPLORE.EXE
PID 436 wrote to memory of 1772	436	iexplore.exe	IEXPLORE.EXE
PID 436 wrote to memory of 1772	436	iexplore.exe	IEXPLORE.EXE
PID 436 wrote to memory of 1772	436	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 876	1772	IEXPLORE.EXE	IEXPLORE.EXE
PID 1772 wrote to memory of 876	1772	IEXPLORE.EXE	IEXPLORE.EXE
PID 1772 wrote to memory of 876	1772	IEXPLORE.EXE	IEXPLORE.EXE
PID 1772 wrote to memory of 876	1772	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\bubbleEffect.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
51eac4332d56be6410517c2c241fa63c

SHA1
b7d1a96f8a17adbfb8adec375109e0f6a47e8efa

SHA256
6d408cee9c4ba469fd2f44325718e8a4b8a8f8a7a5050feef8b414cb40fd1fcd

SHA512
7f1f91934ee192941c234700fc8bdc6c50f8bc894c26af5aeccd8ac5a9bb6e056a87c44dc55234d504499a4a88f7880e23066631ae3cf007d6448e2e389b1ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2e34b52989a0d0af49740f8c84427cd1

SHA1
ab63a1b23056d55b62457ae0ddb416d22597994a

SHA256
7b40fb6b47c80973b1947adab8f779e30df5bd745378b9325177bb222385ad8e

SHA512
c2768f39177049863dfc88cd9b6ef8bd6e432c72aca4909f0e24968b1d235f9a2d46646476af76add1a888ac434267ccef7e8c34a07649bfd1076a219dc494fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f553018cfa435fa2a2e7431e3c2c22ac

SHA1
088776ecc4a232c8810e8f639f06e2cb4582e714

SHA256
520853c856dc256ff29c1a9e192822c77600f374b1f4342c44197776f6515d9c

SHA512
7722a76fa9de306bdfb3e02ae18c6171cfa48286cbcc3ba7730b2c9219725fef7dcf90ee610079ddc2728932e2a788e50712ea867e55e8dab4b92b6fe530fb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cbd4b55941f4a64753e3f7bba3563232

SHA1
880ba2ebcd8b268bb88466ad90657271dfd05765

SHA256
93a1085f93326666903b50b1a980bcadef888668fb1c4e5d621246af9edd7a9f

SHA512
8aefc6cd347a8b4b9850074d451d61194b6903e3f7a89a885de4a78f94c41e125ce938d0c3c57d77416d9909ea748e270ff527acebfb0724d2a20435149e3c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1ad78304cc7981b9ba498ece35278486

SHA1
1ae51b0571417da566a4454e043182b2e01b4626

SHA256
2daa3c476dcd5d6197ce420c6fc8b222dad24ac179a3ba010653f82583248e3c

SHA512
94cc1eb8cbbcbd4fd776da38047f1a2350655ab48d4f7b5e4febd4dc9b91f156e9e4cc77424f4fd85534d04226737c121ee177c7c90c7610d5428a66db4de50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4706cbe79ce16bf4804fdbdf5b01961c

SHA1
7a4ec95d470b54207bffe19ad3d8718d40b17863

SHA256
8290e06f283c03be11b9334ce4032f730a6d2ec94fc646c8d0896d97bf63a470

SHA512
2a76fd88797b9c59e9957a9b2e86db0988e94771e92bf9161cf02b75871dace28ff4ef2f1f738a9a7808702619d5179dd37740d613bf62d5b9eebb484768713f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c4142f475cfc213dca981bbd4c85920a

SHA1
6e6f2b872f027f0a66ddab97503491bd41711950

SHA256
e9b0ec3de94e1d8b4ec836128ed9c5892d4d07838e74baf4504fe773d1e7b2ae

SHA512
366da7f7f478d4488db7dc670d36d0ce4a72fd56673c97d3c2035d8426169117cd25e610f61b5be4b7f02d21d85f87d03417f77e7b114fa9c1c4b403af9e35de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E27.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X708LKIO.txt
Filesize
608B

MD5
96acb0ca0934e83c8f516db29646121f

SHA1
8c105dfba5120af1326cf808fdf688c392f86d94

SHA256
e950fc98032ec172200db26e1f2dd5c3c07eefbf69e855ccadd69bec6b8caa98

SHA512
4d200c03c447246b82d785ea85fe738d0ff8d46a827a5f0659d643790399ab8e9f6114f24afc6e4bf69584c2ffcb30e3b9ac63583039f0cf64cd37874d280607

Download Submit