6245fa164605d119c883a056c185f3fd9c502eba4ef08290bdc053b0db68466e

Resubmissions

06-07-2023 13:22

230706-ql86rabe24 10

23-05-2023 17:55

230523-whe2dshc81 10

Analysis

max time kernel
145s
max time network
136s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06-07-2023 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_21.xml
Size

1KB
MD5

03bea92b5a80210f73284dca552a783e
SHA1

6d8c76be2d7ca6d15e7e89f9cc432866173a8b43
SHA256

cd185d4a912dd849f434d07505a9af77ddd98e2b5d7d2a40a3061dd2b12978a3
SHA512

91bbee4dfc04ee1e8875f6213fec804ffc0a4d8ce584df2eb8191b90a6d1f76685a8c3bbcf15befdd4b71847a299d5f292f079b09a7c3ae8b94af8deb83a81d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A120021-1C00-11EE-AB44-72C39AAF56E6} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502f970f0db0d901	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d400000000020000000000106600000001000020000000cc02954f0338d3e0ef34fc33fd1c946c299df0fccd95ab989a3502d81e4064e9000000000e80000000020000200000006cede8dc694639713589140a23afe6bf7b270be6b52d5a51468db81abba91f9990000000d2733550a9d85ada9252ca212c7ec4b44de43bee9bafeed18422e03b9ff15079c3c44a3af9c1a504ad1b313243ef409382840c7538815526d6606576a0b8ba3622dbd936d601ce8aae232e4f777aee3bf4750b62c58523e43de0678c8aec9fc939bb608579522462ae51249b828b45c1a4b19bbf277e1cf0a6b1395ee91a015d6ea2eff8e487401f3571d132f092c59040000000257484936af8f69098cd60c9997a3bdac708027eee9530f1f0edd334ad08ca2d6b947a1df9778c36dd67edd8b9e40c17cc03b7fd78b527a830ffa09eb7fa78c2	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395414754"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d400000000020000000000106600000001000020000000979e52e892898b76cb4ef90e048cbfaabe0878d08ee1c7fb3f78f418dd1a63d6000000000e80000000020000200000009b7938f8b529783afedd1a915ee7b002bcd6ee39fedbbb8b253f02338693545b20000000bb644219caf36e7c2978b190ccff2763b4db9faf916c3dd72d23c766fe308f144000000095b6e84288f2be1a70dab85bd431c31e3fc245d502e376e67318972265716a9d6924b1a8f0de57b6d3ea09226b329ef926fb2d4517b4560f4e8185add72f4c8f	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2308	3016	MSOXMLED.EXE	28
PID 3016 wrote to memory of 2308	3016	MSOXMLED.EXE	28
PID 3016 wrote to memory of 2308	3016	MSOXMLED.EXE	28
PID 3016 wrote to memory of 2308	3016	MSOXMLED.EXE	28
PID 2308 wrote to memory of 2348	2308	iexplore.exe	29
PID 2308 wrote to memory of 2348	2308	iexplore.exe	29
PID 2308 wrote to memory of 2348	2308	iexplore.exe	29
PID 2308 wrote to memory of 2348	2308	iexplore.exe	29
PID 2348 wrote to memory of 1904	2348	IEXPLORE.EXE	30
PID 2348 wrote to memory of 1904	2348	IEXPLORE.EXE	30
PID 2348 wrote to memory of 1904	2348	IEXPLORE.EXE	30
PID 2348 wrote to memory of 1904	2348	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_21.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1066d2f6441dd37f2be750ed966440f5

SHA1
4a380b9f98a4ca50f99db4ca4b9fdb01118c078b

SHA256
99d92a2ac4006e9051fe5155d4b4c5ea47303d3679d493c7a4e622dfe9b1fb5e

SHA512
83be0a9a764813d74e03a8694e8c186818f705e1010c927251e7fdd9bf798e42f1472843a78d1a90d4e364ac0c849d68676e15b6003da78d574f62135219bfd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238eab5c7fdea29be8f2e76156a37bce

SHA1
d1646be554b626cb107ee76eace8ca0cc8776957

SHA256
25c4f5e362e220a8b5d02750fb0d7d6385c7db867617d9c711c6b9051b33b49a

SHA512
1b9575201e2fcd9cbdbfe66a6327601539e05e7b6acff1ee2ea000fd63f325f30f684d92be8c24795e84cf60adf669f940333cb89c5f5d24f9404050cc6e555e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2941911eb310f38e44c78af55d8586b3

SHA1
e22b0e429aa568097949bce6cdc73d3343ff685b

SHA256
550461c3a27853536e8f23e8c2dff6b163bb977952b326a3f7d534f62ad3f6dc

SHA512
3acaa66ed6d48535f17d4493208fafdba685707a0748d03a0098cc880475f87842883ff4604b9cd71e2302ef1e5abb0bf9e8dce62688ef02efb5d9ac7668ceb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237f90d3b133a8e60ee001df0e3107f3

SHA1
79039c78bffd3e925a7cac49c1711ade79fffa9c

SHA256
fa10aa701db1411d7c566b90d8066788bf7e6ed3ade481a264692fb89b98e20f

SHA512
54ce81d1f90ca3b6e2c04ec34f13677a297c518c47436bd02ef6f02705571973f420f4b4dd42554ce1b745a7df1fa7a6b37156c5cac5bd367df706e88fcbc520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04aadb20b12e38283230c30d5513664a

SHA1
70d76474edffa2a69ccc410ce002b2e829148b32

SHA256
a8f5e8d4e9767a3339bb820438980787a09cede78535da51d6a5e1439ef9706b

SHA512
4c12d41cf12e6ccca9d0261556fc2f051699119b5b531d862a38ea19d6ddeaf151a4e72aed8ad89e0f3bd6b4ecbaca6d64cdab3afb5cdcada444fbceb5cf93bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7167d6a474994a117f2dc5f7bc491c4

SHA1
e2dd4612d4eecb16447b17c7f202cca1bdff8237

SHA256
2d6c8c4039022f370a54eb89583099db0f619e221c92cb0a01cdc0a0e17a3b2f

SHA512
9dc3055a955b87347fe25e789ca6662b1d6b16eaa18de3a302599e544fc76b1e61990a2f4732287464766f7943b5831d588596e13280419d2c52f50606977de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55B2.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5671.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GG2WCJFC.txt

Filesize
601B

MD5
c1e81ed9dab515b533298c664effd515

SHA1
c01c01da267d4912b74e1916a236e5b517352b78

SHA256
65dd8fffdafb22b4866698716cf55fbb9f7d956e98860f4e944ad82e62bf760e

SHA512
14a0bd62dc0c7e213707aa5fab958ed6053ee9e1cec21cec4d943b0a7fa1bd74dd29e77870012e3a1e60d19d51c3687f75885fac8713dddad8ca7519d6c17b71

Download Submit