d3ac941ab8478e215af35976da2212f5ecb6d87de08b24efb37280b10db8b748

Analysis

max time kernel
147s
max time network
137s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

compat0_htc_htc6525lvw.xml
Size

2KB
MD5

657be39eb945071c8110ee2f8f28732b
SHA1

6d7e5be5f992ea02a570e40949811c1d9a2a8a04
SHA256

74534eb7430c02226f8a730058d354a622afce5e760f14530f9541a278ccded6
SHA512

997ac2e79974ec38d523628e9979ab4fb9d8b2b5f06f11f731d2c9677c5ebf2a2cc4eb3b9028bdf20c0b777e9a7ab0a6a5f475df75ad221bac9ebc766e5a5046

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e00000000020000000000106600000001000020000000f326d8d2c63d2cf836772bd0f1ec717760aa4ec0c3843a4c3301d35d64c48759000000000e8000000002000020000000c6f7a4b1c7def3669961aaaf22023a9451ae5be3d4ac6243a395ecc6b173ae41900000006b53c74f8db02f74317a635562d493a7a78c1a0a21fc0e7d2ae0831b3012a5b5d1f755c0eefbe83df8ee59e464e91179db7783fe6e3711bf8f063c3a4796388a13697f268d234750d3986b14c6226bad84b027b766a82c98235ef7d7144dd8c55e2bf410cedfc6a9fdb9707260ece81be982e37995d3a46c64b174da3bd5ddba35b9e5c90daf9c1a8342f2a7bdba40c0400000004d6a80c26edcab48a1fd01d99e1abec58016fbdfece38a952676457679fa321982af5384da20575790726a05d0b4a700a19406e3ee86947e8914150678280ca5	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B59C3651-1CFC-11EE-8725-6EF46A3BE504} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a25f8c09b1d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395523195"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e00000000020000000000106600000001000020000000df81d971ffda675f977c6fd86a7ac9bea4c33a626643fd6628d42f3aaf6ace41000000000e8000000002000020000000f1c0a0f166bbbb95351ad9c0697fdace06aa964bf43f17f1f46aeeec2e596d7020000000cd2e714d53d83b1c50e05bcd42e2e44b482d5f903ea3433da90cf796bc0b3f6540000000785a48dc7977ac1a5c7b88ae04507263f56b86c8712a61b4b90905979b6abdd38d446547df71994fd028fd852794eab68d1282bba82c7b71c6dffe6d1cbe42ac	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2364	3044	MSOXMLED.EXE	29
PID 3044 wrote to memory of 2364	3044	MSOXMLED.EXE	29
PID 3044 wrote to memory of 2364	3044	MSOXMLED.EXE	29
PID 3044 wrote to memory of 2364	3044	MSOXMLED.EXE	29
PID 2364 wrote to memory of 3028	2364	iexplore.exe	30
PID 2364 wrote to memory of 3028	2364	iexplore.exe	30
PID 2364 wrote to memory of 3028	2364	iexplore.exe	30
PID 2364 wrote to memory of 3028	2364	iexplore.exe	30
PID 3028 wrote to memory of 2940	3028	IEXPLORE.EXE	31
PID 3028 wrote to memory of 2940	3028	IEXPLORE.EXE	31
PID 3028 wrote to memory of 2940	3028	IEXPLORE.EXE	31
PID 3028 wrote to memory of 2940	3028	IEXPLORE.EXE	31

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\compat0_htc_htc6525lvw.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
350464784f1d245a4285c0e97c3e64d7

SHA1
e5d3534503b19d9aa30942d65f6498b8816bfc56

SHA256
9b5cad86d8751e0118a24000927a8286c3c720aa04f85f99813478cdf8009903

SHA512
8f401b6ede977cefbc288001b872a53cb99594b67603dd6244e6936758c1e7592dc63b6a9159b20c0963b0d463ff92fb6bcd786573739778b374b3a420a15f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c8379e5711d8d0a7f06772346e6897

SHA1
6eabab5a48ce79a7aaa1daf0dc0b3c1961ac0314

SHA256
3d73a7cf0c52ad4a4ab640e672937e297c30cdb3f185df2c15a93697a49f0f44

SHA512
90cbf7e88cee0b0344320eda284acc6057ccc686e9b588c55097db50fac33471ede911c3b0a966f9cb8f36b9d0c000038547add414181e3bff2017015bd6c99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e81d61fab90c35d2782dcdfd5c62f4d

SHA1
738e16fb9259e4ec38a28e840bfb8bc62a33cb89

SHA256
ec9a7e758d69240b3a7cf1525df5b190bd6a179c50db33e92933e5b259019761

SHA512
bdca498452c556d19088b14a650a7cfd54cf0636f19ca6f101a9ad62575c5dfa72b13a10bafe7e8801a14cdcfc0b6849209ca5c64c89a59c29e5c9e49cb19ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7abbbed8064f529aaedd711a1f083a0

SHA1
591bd957f1a5cd19eb29193aae3710ef925e5a7b

SHA256
662b8ee034ac0169bca198b0fd1990c90ff5d54f6874d275e778070c507b22ef

SHA512
512e05c2ffebff63eab6d66c98451aa974435474226a2d0959d7359e0067219781d43ee8bf0cc4553e9d7e80e6d321896d27aad0e3238b59d5b76f86379c4389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e38632ffa0d999622b34da6c7ad76f1

SHA1
8dedf5d633f44bff41f7ca9da23d99828e96b52a

SHA256
62affbcc1be21df466eaf07f737695fc344e54a7d8fa33a4fc4f82a0422ca4c8

SHA512
ae30e4bbc638ac616aa2013dd9aa860ad03189a6b460bf22db1fdb3ae2639b383b656768d9e7a87800295bfe1830e4e49355f37892161db1fcabf5af730ff804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d8888197c52f5a5b71b22f1cd4355b2

SHA1
3055677744c7e7090e221e12981819fce7fc60b4

SHA256
c297ab1761dda4d3ea5859a5738c6f7010407c3ca9b040435d257fb7a8182fdf

SHA512
81a31c9db9d6227cb629ade082b7fd590bc488db6fde4835af27852c173900098e366d9271530fc4c68c13145d07a7688b839dba4961965b14dbabd3e1774ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10face420b87bad7d17cdafa39765ad7

SHA1
aa7fc26e167bb4ba43e098c33ec23d91dcc61abe

SHA256
5b58c8070d1eb2dc4d194247de4af9d1e10036bd50affba53b1924987c3a8086

SHA512
25530e9a8aa85c82d0d252985006c023378a9bc491d4a39eb36d9ec0fd331652001944b03a00428bedb3620fd99c0656a825001a90a537655050f85c302e71ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba2c23de77f3b85efb2cfe633c9841b

SHA1
5191794d9feb769bcc4a5c14ec5309f6386a081e

SHA256
0edee7e342e6f07858c155601dee201daeeb5ddd9c561169d1a7523b1319b0dc

SHA512
161150d0a68a8e0a9a59ab9b9910c11fd7eb7890300148df5120ed1698f0ea53a0b01f1cc11160d14c7c4f2d0d64bd352c5a8ac09dabebf50e059e63cc6c57cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9211e1a481bce1c06bf6dfc19b8d60c0

SHA1
f95fbad4ca6b3a81565b6665adab9dd3327cbef0

SHA256
0566b55587adfcd49e027eec371a863139b40743b0e88fa1f8292c9e321fad41

SHA512
02d2c9ff40c2ff7db8d9a5a976c3ad6a05250d10829177f6e8f7ccbf6f3cd445171748bec138b26b0a2dff1d711666b79c5dd1b32e88fc665fa45b222f5bc84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DXRMASGZ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab670F.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar682C.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6JVCY0KH.txt

Filesize
605B

MD5
d532bcc5459a6e1212ff9764950a74e7

SHA1
cca0dc07993c9f16ec9a621d3040d9f22e52f2bd

SHA256
8e66a66d706947a6e80c6bb15ccdba98ab9f2117c64d2e4cdc73b7d047f76363

SHA512
0cf3dc7444406e9e93e05122706f0bca3baa26a24d4a4f800bfba36db92ec5445617167ca9192ffcf94b11b21b1229200bf0908aeda0db500f4a3159de7d0648

Download Submit