b653631708cdf4b2ec872b4dca10f3c23380c7a2b2029e20f23b590602d1bcfe

max time kernel
102s
max time network
146s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stella_wa.xml
Size

9KB
MD5

4ee3c0dc45185231589902397c7a4c38
SHA1

28a4882e91c2bbb68562fd9373efe43d24dce3ff
SHA256

8fead4d413917d70a317375083a0cab7bcde24530fed6d9eb39de05bf14348f2
SHA512

c22274e0cfe22cddc65f0d258ec623360ba34d8ddeb09a2e7c88290d949cb20f76cb6e8ba8f02c7f5ee7ef4ab551d2d61f680c1dfa0b9acb30143f76d908eec5
SSDEEP

192:OCxf3sWhw3hysJPiaJfdvLZacjO/SbEgle3iVIept8CMei3ttdLx7Kx:Oa/sW63hNJPV9VZvjbj03ISpei3ttdLI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e00000000020000000000106600000001000020000000253094b64f21537e879b66c4779d940000c1eddd9f8d0998e6f7755f5597ef20000000000e8000000002000020000000c92a7757ba5d5d75c7949555f7960c50222fee033ddcc7d383034e34af2504fa200000007b766d6b22bcf4fc23774a81faca308c8a8b2662d9371e223c46c05fe1253dfa40000000c3a2e7f15261300c47441b3d726b0bf03ff40237de72f00be7f26dc8b59966da1a5f55d2cda876d6ed79a7678146b982fb638a7ced00e2fd8084fa7a67b92433	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b083b59838b0d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2776C91-1C2B-11EE-9613-5E12BD6EB171} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e000000000200000000001066000000010000200000004d8a29663b54c51223e91ccc41f63421eed9863d3bcf963465b1b7f2348421df000000000e8000000002000020000000c77d75248fc72bf1f29d84e723728b8b8d59b0aca6c4516ef52ff579b17bbf8190000000d3c9fc39ac9147f3fd7733effae060bf570bebee27d015b4467090964e3aaff5ea9a46fb548f279858680cb1c7a41a1399f83ff9ee2ba166d1618419603184ffe89c5843bfdb023bdf466c9d370e5167d715537a2ae53862e4fd548733da2597a5beb35c2e0482518d62ec58c848e558adec868a8eee4f363b992ae7155ae8a8ce1aab276130eca0025f2e568e89c8fe40000000f598e426397d0ffc3bcdb99417e5f12e8d5c8e6c0e398a7b627a162c4f5bc9b9b218c1c537b201e7a761d6f5a4f0846895c822ed5726f15022c3a0e087872819	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395433451"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2056	2420	MSOXMLED.EXE	28
PID 2420 wrote to memory of 2056	2420	MSOXMLED.EXE	28
PID 2420 wrote to memory of 2056	2420	MSOXMLED.EXE	28
PID 2420 wrote to memory of 2056	2420	MSOXMLED.EXE	28
PID 2056 wrote to memory of 2428	2056	iexplore.exe	29
PID 2056 wrote to memory of 2428	2056	iexplore.exe	29
PID 2056 wrote to memory of 2428	2056	iexplore.exe	29
PID 2056 wrote to memory of 2428	2056	iexplore.exe	29
PID 2428 wrote to memory of 2948	2428	IEXPLORE.EXE	30
PID 2428 wrote to memory of 2948	2428	IEXPLORE.EXE	30
PID 2428 wrote to memory of 2948	2428	IEXPLORE.EXE	30
PID 2428 wrote to memory of 2948	2428	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\stella_wa.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b6ac4ea0a1251d468eb1cb39bde20b0

SHA1
da4bf1b8e3e82f12b432a09db0ee83f6e819431e

SHA256
f75ed3b34948c73c2a737306b2366107e78da4787d66abdb9e7c4adcdea55be5

SHA512
c6225a01fec538b4ad2931c16b9cea8131a2060464c4c5f5cf0f4fd4978ee35d46c6a87eb805407384826380a0424042b592773225e2247f0ae4852a1632f6d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a82231f864acfbee9aaaf6964bd7818

SHA1
aa401e60b4c2942cdab81aaf71d84cab9d6eeae9

SHA256
3aa20e2eb99bfee43bbf00a4d3ed018fb1f12bbe35fe1f874ae8e09dc3fd148b

SHA512
74ab692d146fcef8c5ef3c9c099cd42b4d39aed6ff36706817118c936f81f2ad35711c0653571a820f2aa20ebaffcb7d3eb67acb58ff71de0d5935fb7ba57b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fbf43b5d3a37d60497a8c047b77c969

SHA1
aae94ddb8b51c1095b482d0c7e091495fdd6412f

SHA256
fab257b09a915501c4107c416631ea24de4ad0fe8aacba0d9ffa87fa7767f457

SHA512
d4cc7d1a9ef0372801a6fdde69db15fcd64868cddcec56869bfd53e3eb76b5b8adf57ee47db41ef2c7cfb83bb337ddd778d5e88769db1fa5821dfeac365ed1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c10dc22a9d7495ffb1cbdc1096c9a3

SHA1
1a8a9e6d12f7545e5511c2026bd9caac2f7adeff

SHA256
e5ff476308783c893da9f2dfbf2a9a70e0520115d9a0e7794a87bbbf33fbb126

SHA512
48dca722c256f7805a5d3e91a5f1e2a95c3ea1fcbec47e7f3d2ac41dec28e856b7e7669495580ed798d788ec4b7df6515ea09d5ae9c60376fa9b3162bd6cb7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbfc0a3e46d9881f17208d5ad4285e3

SHA1
ed1839e2cee1f9d8b695e15698052bd9b9cebc42

SHA256
1743f442028b1c676197a83b37b941bec7219d4c8ce3f98571ae4db43730aab2

SHA512
b0bec0fc079beff4989b25e2c2f0212ede2c1ec76e43002865b99e95d9a315e2e97b4de5e9093d82762c6530ba67dcb9ee5737347515733cc0492f9656fc7688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6590409b1620623845c02acddef4750f

SHA1
056186e38368b26d4daead3d75a414552d2dc582

SHA256
bfda4adb2734c01d82376077029a1c4fc600ce993a6f34e3d63005839c5afdfd

SHA512
977ed5f1e9206bbaaa05eb877b024bce70b2690ddf56bd8592aae1c747254e73b978caf0175cab929b3cf614c332591f96c862e1c8f8f278ad0fed111ca43905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cdf2d1fb4d95e87066f84736ec6e51f

SHA1
198395242c46a3e89089416f9cce6d3ca64f2ff3

SHA256
0f20e5176820ab086eeb993c11e2dd4b459ef739e0c14e666cb14d88b56692d5

SHA512
f19c28317c0560b5bf5ec457d0d8ce36912e136fcd559ab544436d92e7e62ff4cd4c356da03d9453395ada6c4c58752c3d6a3ba34db5073c632b69d9f2274c18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f922488de7ead276b48c136f3ae158

SHA1
2d6c8dab1e8212fa9dd7f2056e6fe606e2cdbdf6

SHA256
222f35622f1f9e49228596708afb428dbc02fb1611fd2cdbd89e6800dd476db2

SHA512
6127a1ccca2efddd071bbc1988c3b005e3bcd43335131361a2ecec0720191556b447ac83614edf2c6761c82dfca507ea9aff6883e07b9d479e5c90510d97de84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681b21b4ab62423086f14e6eb9e4dd01

SHA1
398625e4b2caf886f98980883fc1b7a6595971c0

SHA256
55dab69c4aea475f7656854ce213c55c1afa36da8d0a62a98207a1429959e03e

SHA512
c53dd6d54d401736df5c7562c7e2364eaa41e6b8e04476706f91237ee32e7a0ae2ae1af41c683b93bb6a638b554e8ca587d693e4445861127ce37a80d1175367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IXTVO3I9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B90.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C9D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JW39229O.txt

Filesize
606B

MD5
a8054378ce463cf7b3af624445c7fcbe

SHA1
75de360492467cbbc844b98012dcb8b81180834e

SHA256
d4219aebf848aa7d515858e48285329efdca0423393c6997dfe94ac48a67bb18

SHA512
cf7bf8dc318d986aaeccfe4252b7827c4f54d0e539135f4039d0b9dc83583830bd37e8cacd4cbccfb6566907424fc976485f6fd76938433994301394bd1a2949

Download Submit

Resubmissions

Analysis