dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
147s
max time network
137s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12-07-2023 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/TRK/adaptusr.htm
Size

1KB
MD5

1b107200dff1d294b3ff1433d8c31093
SHA1

634e721674ad31acb40d07875dcd041ba611af5b
SHA256

55c0e78a88b34ab3cf48c7aafd745fec474ee5d0c4a07a2ddf36dcfb7108b2e2
SHA512

8c1754a7a59f175aebebc38899816250735a15bc76b4c43ff65ca79725de3a6845d61a33acfcc5f65aa711630e1654420897c2fffa3759f67898ee80f30a9b79

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000079aadbcc12564442a62aad76c0e1e2aa0000000002000000000010660000000100002000000003505c492ed2d9bb437237d6d4dfaf95443879562e57e68c176006e7f4223f2e000000000e8000000002000020000000116f06568630a3a9a920557a0f6d54e2d1fe00bd138488494c7d0befa55da10d200000008cb1518314f89448f08f79a6773d10389834aa92a964de1305dc0c8885cd751b400000006653bccaf4ebd4569203a085f1d595576e155ffe516bbdb165c03879ad661593827ec6efff757722cd3099f0145a1ad997ef58cc8ce95dc97c7ba8ea57541a04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904967"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c002406d82b4d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000079aadbcc12564442a62aad76c0e1e2aa000000000200000000001066000000010000200000005c920021af8b8bb3cae43286a7357c676d9a5a259056f4c0e05d84612dbdcfe4000000000e8000000002000020000000843d914eb32b115c9be2632079fe64a4e2adcaaac0f33c363eba281178a7ac2490000000aa5f13192302710152434205ce272c5afc8b25b8b14dff35639835ddd81b8188ebce8826472bc90540e37086c01434dcdf79fb77339026c44aabdf48e5567ed810cb8626a7635e70571e74104e35cec59b87da1dad8a4c4fcd231983dad4f73c4d0909fca6e1093d9ea9234ed53b7f845a8ca49343747f07a77f50b98d1310005694d44fe5dc39cd99bbb7046b25f75b400000006b5a3aec87cf1036fd10b5aaa6342cac917a6355feec76e60f1110bba1d56c917fba0f5be5b57c3210e91ea0790aa12a6c31b683fd9d2033642cb761e48b4643	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{975C11C1-2075-11EE-972C-5E12BD6EB171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
524	IEXPLORE.EXE
524	IEXPLORE.EXE
524	IEXPLORE.EXE
524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 524	1100	iexplore.exe	29
PID 1100 wrote to memory of 524	1100	iexplore.exe	29
PID 1100 wrote to memory of 524	1100	iexplore.exe	29
PID 1100 wrote to memory of 524	1100	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\TRK\adaptusr.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf33b3d94c968fa48e0e2fa2cceb485

SHA1
07748101e01f0e4042bfb41c53abfb4590b9343d

SHA256
a1c3be390d745d54078c3205cb3daf84ead42677e8ba75cdea2f70e88334e9f2

SHA512
6e705c73400c7c85d09fc72a0927b6482ccb3a4f6581d315179d553baeae1c94fcc250150ace58000f5d937e7694042b274d93d9fde0542f727d2082182c7c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aee87b8e1e68b4f4d980a89f9e4e369f

SHA1
6b171e2cd4e5df5f01ecbcd0a07055c2e2b1c723

SHA256
f7cf8533888fc63d556b312a4d3fb84fa436d9d13971f4cc2926d4066a475da0

SHA512
eda866894532082ad99d5e8880ee3dce30b9e296aed5f786d45c4553a9827f7d75376b0bada53db5b98ad334896f816de8dca4627899e11dba525253b57c481a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770db55159393a08c42f7e2848993644

SHA1
4dd86bf67d0e9dfb230aea117fa505d3395dc637

SHA256
7b9eaac88aadeba48221be4f9d529959e8283efa81398af5f9e45db7731a1ad1

SHA512
c69818af614c2bd856dc9a7813ad54806d9b0bb15bb2894ee2d6f175e0f40ed2816f7ec6ace6de33d5ac5602b774e574deb0744ef2af5112314a5845575fc6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0975537798d6a7ec392ad0a213853556

SHA1
841036afa0252be6845d06e63c89359497f36c9f

SHA256
55233e4f3df4e5cc8f729fd44688c4c668221805bfbe2bfb500d4ce2ac98edab

SHA512
be1f743a06767e2900ec89f606ae510c99e282bc9d63e1965f1a56bc36af67b30e11bfa0d5711b3aff9a3bf3427d48e3846129eb7028af2f5fe8d0f92b65e18c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb65f8a936ec1d08e827603d543446e8

SHA1
17fdd8dd97f0fd2923897aab8ccf4ef96361bb7c

SHA256
f3ee43c3f4765dddf4d2328b0b56732dd3981862a8758c609507d5b0c28ad422

SHA512
59bf6491d016a28b04361b83a89c9227247c270ffe2d104ebc3a7766c5409c727a2e223d0785546eb6b3e777c2f33bd309f92da4b392931819d4ed505e940f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a598d97709e6c8f22aef9ee2ba4494c

SHA1
846d73feee0ec231a872ec0d02a53fb13eb8250b

SHA256
6b41d5093abc7938a16a7f12ed00c532a8227d6e5511be29772652377cdc8a4c

SHA512
e785640625c3cb7dfaaa6c8637937d379f14b2cb656f0288a95d65e6cc258dd5a1a1fb7b06d9686653c737b713aacaafc2aabb54a7c2c49e7dd6ce9a5542b4c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9daf3dac486be06377b5e5d03b7d56c

SHA1
1665756b7093bb6a016db2dc80bf4e357e5941ae

SHA256
bb8c6df84c36603aa022ccb006db551c8ad1039e777a711afedaacbab6c6a199

SHA512
b1211f153d1dddb1859eb3f26d9110b769ebdbf7819bf9483e14dfcf63144fb09f0f305448e27fb21c80fa46ad70c206ce422a657b0fd34cea45dbdf37704cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188b3f44c89b379ed84321da283c90e6

SHA1
02616737a6680994db499fbe249b8d1842ca4bfe

SHA256
cb4e2f4dfbb830017571ab4dbb68018e64f28d7e17dba78a1222b23521eab0c3

SHA512
a005339129c23a53a542eb38e2e5984d25bed791dafb86b7bbc0b1a65cb9fe616206d7391b3d53fd6b74c12dde07f0f3ede328223795ad1d8dbfbaef65396cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5322edbe0282286dd2ea4e030d5a9fd

SHA1
d78ffdb029be8c85a988354eae16fbcd7aa5252e

SHA256
948d4bdf21dc07990c6ac05fa2f82b195cb5a349e0c836b1c2b0db3676316ba8

SHA512
a462fb2c38f7b9411d515db6b2ded2ab7176edc118ef333e92a8e7b047f4217459ad2856900f7b4df3e0d05085fcc31b501caa346e79eafe53673bea89395471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
391ad79bc734c8526e3dd12b852b0926

SHA1
1cca6370971e3d642f86d565f956988ef1b9cfdb

SHA256
0d2270b0b7366d8a7408bce38ecad9cdb7489f26fa2b14a7d4e7f83cc4460344

SHA512
e968bde839510377cdd28f3524714515d6caf801274fbf48841546d29c1f5280cf91f4e99817dba409c41aede8c0b9dc49b095c5ceb7b8a1daa39557952bc327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dce099ced0bc5a44b9426480a1739157

SHA1
7c0fbe507751b727bf5ab8d90b8859ed07ff2d32

SHA256
4c709539599fc2f86abc4e19b3ca351b5c79559db5fce6f519b5d4481166f665

SHA512
dae93d26a94eda625a47c5fa9f9960cccfbd60c679463df6811e7f5cca05b388b4ba3f7ee69d06a564daf13bec0372c7325ed93cb0fe33534bf1df517d541407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M70DY8PN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55C1.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar570D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1KNU6N51.txt

Filesize
601B

MD5
d0d77b84d21424cb03336398afc6d8bb

SHA1
78530fd3c73f50b8bb1862ef9b499950a3eca425

SHA256
ce389474cbfc25c99cf2b5e0f4e4c65caef971eabffacd2667cf9cd9f544fc5e

SHA512
ee5a03d6a51f72876d9fc416ce754f986b3e93a7a22ffb9bd82a98cab0465d6ac462744113d04cf13290e4e9e598ce1b907063b31b03c2cab2d0c06c08bb382e

Download Submit