f45dcbd13c47c789a90d8e0728abb588ab63ab0911530fec579cb18100a21f40

Analysis

max time kernel
103s
max time network
151s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

settings.xml
Size

2KB
MD5

ba17ade8a8e3ee221377534c8136f617
SHA1

8e17e2aec423a8e6fb43e8cbe6215040217bb8a3
SHA256

ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
SHA512

c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c500000000002000000000010660000000100002000000035ff8ce75462845d5d013d400f2d6711da6022889fe76f61ef08b729c4138093000000000e8000000002000020000000a8991d7b2512764b3af69a2f63e58753a230a56dd9a673d87a7717b830a0a82890000000a0b80646e558c2600d4ac5e272118a14c8621598732c2127520dc091d6afc638e1ca1fc595cfe89827d8dc557753abb4b5bc2d90ad2025df3584e755d42dfb2eb2dc1d68d8116b6fd904d79b73b5c5b94d183f5e6cdf633767a83b7707f4ea28b093f9d2708382ee57c288c732080d5e0ddc9118477fbb59028846d57404bd4ed6dde8f89043b75a985190e003a2117e400000007be6be8885576df245cac85acce7ff840f02af388c634f2cacabe2240220087912cad6ae11b3e51779009dd86d69673483602e9c8c4bfb69a915a38110357dfa	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c5000000000020000000000106600000001000020000000510df152010d1d8895d0422a4abd52c733682d8460c222db1c484b0b12bf905d000000000e800000000200002000000098bceaf9c4dffa1bc01b7ea2e97ead5bd6d0330fd5e8f465711329e55eca40ae20000000d5177e9e859740ec6ccdb755d1f8e56d96df82056ae3658efbd56113488b9151400000002fd035813151029363b7972796026b80a6e0c05b6607aa3fbb99256fe2f440eae910a45962593669de85e4432b0cfc2802ed034de2e84fc21ae5ce0ac3a285ac	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e35e467bb0d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{700DB1B1-1C6E-11EE-8F6A-7AA314CC78BD} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395462089"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2272	2108	MSOXMLED.EXE	27
PID 2108 wrote to memory of 2272	2108	MSOXMLED.EXE	27
PID 2108 wrote to memory of 2272	2108	MSOXMLED.EXE	27
PID 2108 wrote to memory of 2272	2108	MSOXMLED.EXE	27
PID 2272 wrote to memory of 2988	2272	iexplore.exe	28
PID 2272 wrote to memory of 2988	2272	iexplore.exe	28
PID 2272 wrote to memory of 2988	2272	iexplore.exe	28
PID 2272 wrote to memory of 2988	2272	iexplore.exe	28
PID 2988 wrote to memory of 2156	2988	IEXPLORE.EXE	29
PID 2988 wrote to memory of 2156	2988	IEXPLORE.EXE	29
PID 2988 wrote to memory of 2156	2988	IEXPLORE.EXE	29
PID 2988 wrote to memory of 2156	2988	IEXPLORE.EXE	29

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\settings.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88e62681956e98d71abb9979021cef48

SHA1
19e7df009091c12ae77e09d0cf611340e1b0771d

SHA256
46f7666f44213ffffa3a5b34c0aa6e0daae2570b655c05fb76fa6a302d612bc5

SHA512
705c90d361fb5a25dbb4934c945710a2920219d0f97f49491541e49a33af3561f5f6f751394dc6ea28e28d10a5bac6655a77e0ac6a37d4826dea9b3a80557f21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4249a47803f0da1093ed029ff5e601e6

SHA1
ff25fe83bb69b3eeda77fd5731fb57e46ee12801

SHA256
3bd6f813c44826983685dc8d32dee624e532fe5d30ccc1a4d0ebadd9d76b819c

SHA512
c20bdd2b94e2eefd9e64a261e90cc390148cfd115aa492b23f3bbe024134f34490a33ba49fe58861309fc3c8265d65fed7d896c1c32646c340a7c472876a34fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bba97f2330ba5b05f5f53e47e05fa7d

SHA1
b476e25077e85ed9e629ff1c625a9d00c79121c8

SHA256
c8e11ae7b6a8b6b335ec4d9041552bcb4b8f90bb8bef8e3c821fc4fbf6653a69

SHA512
f058a6b1600aeda70a369572d80a9d3e9a5878b9b5f5558d718a4500d6d518c3e069114bd8b4d2223ec8ebbbc38ebfecd07eeea572740915a1fcde766c5b6eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bfd447155d780eb47cee817f5538c8a

SHA1
05ffee3ef0949dddc4c246333b329b43ce9b2f4c

SHA256
545d8478d90aedde616882d1a2686224fc36b8ab96648d716de267022bb67c71

SHA512
11bfc6b20f314f7b4eae85d08d1f2d00e97c8b466430898dd4ed19ca2fb097f4fcc631db23e61986d5c608c95f9bcdc2c51b7c1193096517a06dd3eaade7bbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ff8f8eb66bcea1e377f451e0432a3f

SHA1
596514cd566a5e58e0a00cfa998be3f657cd82df

SHA256
bfbf927e173e16ca9b27094cba1f2b8378fb559c5c34147c1137d1e012cdce01

SHA512
6254d25fc795859b6003f70996dc14f60fd80d07cfebdaecae57b1a4adc9825650cbd82016415c92071babf34abce8e5eac8029ac243e774ae19a0860e67bc2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec4785e15c9d06631917c277f8832af9

SHA1
68a700ee6058ef721e4abea77effe4501f110589

SHA256
af2de5aab99d16946e39b9e656816c8347c8f27953cb2375205ebbd1d4597112

SHA512
c859885525b70baa8a60cbd25a3b0bc1315ef5f2346eec6d38589944d8ad72343c63b79d7e596f764d294d01d15d1e6f8c55937788840a640fcdfb93d92584ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c379d465f455a8783297a972de5795

SHA1
40ab84e147fa8bc7dc252a75f859b625c78343da

SHA256
7daa831aca96fcb926a4857bc5ea0020e780ff4d0c0407bb4c91318ae1cfd151

SHA512
73af602935e6f7b8c3a81a903b9b8b4d1212b5dfe53eeb74e417c57433025123778ba5f7479794c1c2cbda0e6097807afe397ac2515b10728c132af114436848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180fed53ffaad4649e3bacaa09fc1401

SHA1
062e803eb3d5a21851b9ae1e3510fd47ee8edab0

SHA256
d44c2700f32b7939ddb4e495b9a620dbe4c44e7820a23f7523b8c7b409910ac5

SHA512
faf0b6206189c749aae31f049dcacc9085e442836f176b8fdbaa1ff751e368e8f1a009c7a12f0e23fe4f29722b9aa6ea1894eb08a4eda6eeeaacfbfd8043594a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
526d94362e9c371dcd5e5337a76a1b2c

SHA1
39a9b4214ac1d51c937e756c63b7286cbd3596f5

SHA256
856731e267420bacf50837e62b805130c0f5fdefeaf21a01640005ad17fd55b8

SHA512
fcfd905246277f79c1fe67f0c94298e730d170a0726b925a2934701c54da65c5eefcefbe595fe8b31869f12bdadecbe70af24cc60609ccd1b628fe227bb54ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6f49c4423ab261cc2d9ee54cdad88f6

SHA1
102383916be75734b190ccf2d61c99d6640ee76e

SHA256
86804d88ae6eedf5aadccfd2a9633f4bbc9c85feac7572a0ef677fde36b78f7d

SHA512
9d357848ee172ad032dc2480e4a26e2c2ee8e498cf8b333c1c707850a4275e5651a3c6c8d493f9ddc542994971e119b4af3e32843cbbf733ac9d941351eb5c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8F3.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB2A.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8ARDFTVH.txt

Filesize
606B

MD5
d0b91b6b82f1a981beadeed0a81e3151

SHA1
f1346986138166fa0e14625c86f93cb2d515fe05

SHA256
d19788caf824dcb09254f548506c9a1a4a12b4e4b89271b38cfc5c424684f66e

SHA512
718e41cb9243ab2cdcfdb29c52f0fc5907d0d31485713d3948ae3fe2832f4dd842508c664db4d95b0a663591f4587e383d9321021405b2ff70ee9708c69fe9ef

Download Submit