dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
151s
max time network
142s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/THA/adaptusr.htm
Size

1KB
MD5

a4d5f21ac10ef17bb8e57a7766674b72
SHA1

c265b9e4f37ff84e96853c6a9fcdd2a8c8b90933
SHA256

fe1a277b1a3f82a515e5111ffe278af442138dbc7d1dad22b53de0f40de1a20f
SHA512

40ffee7746f3d9b14fbddd96bf50d5a2cc759ecf6a86a09627fb5dabddbf331e1268e15cb39dcea6b468837d82ceb322f54720533ec124dc7f92107db0bfd849

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f6456d82b4d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{979AA161-2075-11EE-8AC5-72C39AAF56E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c50000000000200000000001066000000010000200000003b8d41acc6771326f823858182b5cd0318103c7f32b2e50b2bdce64c78242900000000000e8000000002000020000000a684b5b86162e8c94feecfb93b8135d52070c4e61004f7cb4a4c25492587ff7190000000ad21e976ff32621252c2478efe406e57e1820969160989ddbcfdfbd86d8823f94c5937ea8610eb7162f90ba2478a3dd5228187721e312788cf53f5f3f1ec2c5915fd8c221513ceeedd0c3d28a7296611c4411bc2d408d8e74c52a38639479df757f59a393b76aaa81247890187f2c14cf8ad38639b7fbdaa14bc6dcaac707702cabfd95b363bc05007c0b4fe50dddac74000000017178b1fedc88a3e9e7d8a7141bb27a3a16b6dad665d845d06d7edfab934f88f87e4fd8557e6b69df213bfd8da41c7a18f723b73231ffcaf4ca20f8a3419c934	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c5000000000020000000000106600000001000020000000bb68f1514ec24d6aa0451c38db5c3ff040f6af29e38cc50128e4821eedfcc7d9000000000e800000000200002000000012c71d28090b5700c402609cf4c06cabd44f94f1f985f24d1b63a09ea8c9bdf62000000014698a43055f53756a240dc1762b0f45118a64ad6a79e19f14de33ec647566f640000000cf80b42838b86296dd77bf3315ce4978fa6d3ccfa2c523c95ace5b77a0baf72a059516aabd14e7550197b8c3012d98e748a278b212e330df290a8dbcf0112add	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1980	2400	iexplore.exe	28
PID 2400 wrote to memory of 1980	2400	iexplore.exe	28
PID 2400 wrote to memory of 1980	2400	iexplore.exe	28
PID 2400 wrote to memory of 1980	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\THA\adaptusr.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af6015d1476837ef045e4d9c7e96705

SHA1
9d993e637904f1a8d4dec5348128b58dc64205ed

SHA256
e15a8d2ab43acc81a361f17ebe5ca032c12ffa330261c496f5c3a12681779b59

SHA512
ce5762ae107b114f2dbcf377c0cf45b6c76b4a49b46f1389e1b2fc268ead0c4f3e7f4da364b509603ebe5aef0ce10ee46bf3cc704e2cd19fa8ff559d73100d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b550310239773763ae6a649b9ee4cfc

SHA1
b3085ba782f30fa97b8fe2e7818c2bb9a4da124b

SHA256
4de6cbeb2fcd0d742b7c7d9319164445fe4696bf9ba9bdeb355fc78d096072f5

SHA512
995fed73c6696c6e49d6c54635ebf62a09ce2430695a5545c48434ae0108b3691d62f2313745522dc2acaa0148c169f80e8291bb5aa8f555f563ee107b78b82a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e01a1b8903c19d4923910f9059d1629c

SHA1
81ef643c5e97a5915ba63f8053401a79e40e414b

SHA256
72f3e90eb3cdcaa125989c840264afd2f4f14c90788f7ede5dbc3ee977669a38

SHA512
85b08a753cd0d38fd5db488530210bbd07572fc85a7e39ff96bf11ffe30cecebc9c7bfba7360f27b1b58f3a55c341d49ee114b9ef194b2de75c76e5b13bd9299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de3528bc5f81d6f4e017d3f705153599

SHA1
2a4e4ddddb46d1515006ec29b0e4d4b52d9fcd57

SHA256
b050fba942019a223f7989dbf62548eedd7b5831aa7ad5d494e51dea83f0befa

SHA512
52e2bda17fc4b521941198edad00af0e7f00f3981fb23225bf98704c40d555e9a42e9b879477ce67b050483e9ba326d2409a5b3df6ef0d521b8393b5baff651d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289dbb9fc8a5fe97aebba6656de8cdca

SHA1
b54551674e5eb882c5b392e114bba5b4b82c97cf

SHA256
cf3a46a3d665f88e7823c93993efcf44dac0b14d196be0587d68b43092e17994

SHA512
e3ba6274fc5774fa8179d48239827c4c4c43abbc86ff255e0fc84f6bf0689735bdedc597741bedb436d024106b867f848eb3bd68578e1a452c315b06858a940b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92c1c449057a7f93c31679b32f29a3a

SHA1
059f93db64b8d59ab4e0ceaa95c44e4a26099f7d

SHA256
4d8a3c4852dc6e4b110415c7692a57e1a9d22e7f2bf843806ee1bdbe5f08be1c

SHA512
18f691c1aa0af48bdc7cef5eded1467bc4f05c5d39e6697fa9cb2918bc9547d0cf1b777bfe9786b4321d5373cfe7cf8de67529cde2e85dfe5c508187d564579c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae6a95a70db9662967e52eed8101ea1a

SHA1
ea99d008b63c2946752525b72ed4c0f111fb889e

SHA256
e050fedfd816d00fd80089277873d454aa76848da6987b4af4f2b7de8c8467a1

SHA512
d14b29bef1abccd6d2637760f3bb7eded40a402b6e0eda37b44c21965fb3e462f6de0c6a8360b94212a73aa48115ddadda52452d24f3097495463ab811217cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0373b35c80daadb07614a57b675a1e13

SHA1
25109a16a3372ddce6ba6c2cd170c3e7ffec4626

SHA256
feb73ba5447e200bb1ff5f94e31acbb96e7f06d969940dff7af6fa97db42d870

SHA512
9b46ac30355a0b09b22ba8529c184727e82f290aa525ae24b14d9f9600148f6971ede7871338aa276635bf88b0a538e38c0545de967388b8cf293863cad178a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b1817d9c526de1d13d7baf6132eebc

SHA1
d69e20df1c012120dba2f073801721e97a649d93

SHA256
a7577db542f890eed4513027d90afbe4592e734607b6d17d11087d1fdd3f623e

SHA512
191298b4ab54ddfe9ddbe6727f7f89f27d8d0425afd9e057d4f53d67376ab04fa73435650381660c8343333aef96a010803745027be93da8a9575e3a65578803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E3F.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E92.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RX16N98P.txt

Filesize
601B

MD5
fba144cbada0969f2729ea7760e957a5

SHA1
062e5102fdab53f9874731821952e85ec117dcbb

SHA256
fa963f010a1484bdae8e56fa72516c92e734ac7205929078c63e7ce9cc5d631c

SHA512
a3057c737826703d4c19adadde088309da92afcd1f61c3414ca03276f05ad6ef9042ee2ec718fe089772f8e2a10e80c66f3b49259e6c52424f08020224773e2e

Download Submit