dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/releasenotes.htm
Size

3KB
MD5

60c3b41cdebe4f0f3b16cb5244ed208b
SHA1

fcb5428e542ba277c4db1c21a5cb55c08e4a80ef
SHA256

cd519f60e3a2e8f0ce9587b26de1cf8c5d280096719dfe6ccbf9a9de9738e821
SHA512

addba52f83558b3ea0bcfa4fc52f9750895582304690630358e71667ee34ba3949627a4d12f597b68dd3e327c9c8248720fbe9f207e75f1443de5599b8eb36c4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d4000000000200000000001066000000010000200000003c6ac894805d65f610f7d7c1faa260da4932d9210455e1752c4c46df3ca0b2a7000000000e80000000020000200000004b635a8a17453fffb409fc18e3f944e036a4b94806299e2136dee82cb9704d78900000008cd7e8115f71aa729726d0e89b76816f9438154561811c17734fe0c5ebbefa47123cc41a0fdd859bbae8fbec6cf6a16c0ab4dfc6814e139234207ccfe0e4470aae2726ba91d37d8b33219cc07a6cfec36e3e1bad3b8f99c52c8074627a2c7e5427b6429b8397c8295267042a82add93cfd55c22c3876f8d98e6febefab64f85f2600ddd74994f68c894651b45fbe5d9340000000baae5e24f78614b8f3f6ad58323f52c23df40eec79a0d0df42b42915153e2058b355b4bef233659ba0599c0a196c916bb3f6e201c4be8553e80a9e0db697db20	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96B5BFA1-2075-11EE-A7C9-5E3D0D3867FE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07be56b82b4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d4000000000200000000001066000000010000200000006f1513fdd42abacf1b0b15b5d132fe7a5c8caf4cdd346513bb86a87a062e38cc000000000e8000000002000020000000f19b6a1f4432cfdf76fe9ead145c81850834e1930c1121fb0ca2ebc7eeb7d95e2000000050af2e9e901b668fd8ca5bd20be328e9d37e984fc02aabce3455775ee4737b00400000002969ea36f493b6a85e9c75447e30ccf7950e474c68a4b155f4184349b4818b3492f2bc84ae00c6c653a6eb6fdb46205b9dc0809893b7c67e64fe00c9309a4697	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2044	3032	iexplore.exe	28
PID 3032 wrote to memory of 2044	3032	iexplore.exe	28
PID 3032 wrote to memory of 2044	3032	iexplore.exe	28
PID 3032 wrote to memory of 2044	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\releasenotes.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
665c1945b3892191b3d8cf6d2dddd420

SHA1
3219620d6c4006e692bf80d9f55bb48b86782e5d

SHA256
702e85053f8ec0bd508c63186bc8395be041ca49adb97f2ea3a3dac389c50496

SHA512
ffca3fe0b8626c0ec97e2fb8d5a5d327021b70a7a53422dd5a48d0cc51c41584328e8f0d35e1fc8e6a4d94a517e5bac12df470e4a371401faa26dd791f52ac80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a9f694c9f43e7590b7db86648996d5

SHA1
390c17a8cdb1a23bfb2e25e8598efb7d15f1df7c

SHA256
958155cc1fc29c1bae88b61a29e2b39c9e3778f86d5c0eb33346e70de6656a92

SHA512
00397464a5e495e6537f9f054c106a8da8c55491e830d60f7e37d5f6fa7df8dc1371702fab40d5e091b91df4b3f45247b790ae90ecf092d31a9b6fd2dd3df196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b896d620ccdfb076fafb74964bd6e94

SHA1
b21c9c5379dfa3f824a2f5cfa752dce42d12bc06

SHA256
2d94fc81d3249b0032d713971d6cd6fd20551eb82385003126c9a5e17cb22a7e

SHA512
f18dfa6dd496a82aa2fc2871f2ee63dc52ecff13eb1cebd97b97f9a098e18ef76655da932b5a61a5bdc80a8dd5ae16691c70cbc862555427c5afd603ade6fe6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28839b62b3e39b0c76aa67c3f5706ef4

SHA1
38102ed9f3d98a3eb33c8990799fa18f4e9cded1

SHA256
a426afdc2d39c01b58d24f832bb5eaa25c7548328e8f21cbc787b335d9acb92a

SHA512
9365bb47178954710c6e30754850e9ea85bcea295065be7bf4e59c9622a5fb863e9a678284ba3217f8ef260fff4faa0cf9b4416c853c7e8cd25617862f3278af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc91b18afa0fa5dd57ac48cc2d1a1fa

SHA1
533c2a3ca8a99791e98730b5a48a038c188f5dab

SHA256
b8ddf2d1e3085adc21e5dfce48ea2aa203f97ffd7ddec08e58d03a42f0d463e2

SHA512
2fc4f87ac7e8097ac94d99b99f97b13075837e87cf57c4f908a4615ad726971b788319ec2ae786b3bf64fa71130d0630e0a715b346fe3862e3608182e00a2aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b7e085b3a17c8cb3323a0539d56ce2d

SHA1
39acf0cf858b8eaf0e0c5cce70f7683844cae8de

SHA256
7432ad388a9a7053d9584153ee8ee303f8ea2e14221dd9661bd6d7aa710059e2

SHA512
7246e73be098e9d868d457d04e5b8f82f98a367ccec52b09cb2e5ef72847c1b1244d266d9b8df272f3d85a2d0329f114d653de365202ac4ab5a6fc54843d7a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5458758bf296086c11a226ba771e7880

SHA1
ad6c4ddbcfc9db44186a68ecadf78d8d8424e028

SHA256
3880278a2e2a97cec0078efdda02ec33ea41ddc0598027295fd14711f48be5c0

SHA512
e34deb03d564e8f7c74248068f35aa91101865030544c94a3b124da51f134523a443b573151d426f64728462970987fe562e2257e146fcb3fdcafb0c25202872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b912a229df58a82dfea016db9afd4723

SHA1
58d6f38fc8bffc0c8854029961a9ebd7f9de1e26

SHA256
2748fee252f87d20133b02a7ea756fa224e94168d6dea3c005ba80f0d44353e5

SHA512
f272823a8c24f05afab983093525ca7e94f79223368bceb4ff6daf329a2d4d9fbcbd72bb6a6e3243d06fd9bc0c110c5bc254969b9a961ae6713f60763e37a484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
260a1950e1affceab15637bdf66693b9

SHA1
82589b882286622783d4328a2ec6203c407e3058

SHA256
efbc5338b7be948eb305a036ac642fa259fbed174fd34de14441355e9a53d307

SHA512
fec174932371bd02d48c2b0a18271596bb4d13026cdbe7d4dd2fff501f94d5e5058b0efd76ce1e26c5353e3da6cfc4d3c603487d34c4119145354ca002af7acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D12.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0F.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ETX1WHTB.txt

Filesize
601B

MD5
e9f6787e459fa10fff513fb1111f84db

SHA1
2df502d72e2e721bff0f41f6eef3f1389ab6277e

SHA256
11845f953459f8cbaa674259c091781649cf98808d34c7ab5dd5c9c435ac7a0e

SHA512
44775b43d862fb9a062048295858d6eaff0c95919a4f4fa4e0a4bc8eb959d916a4d71352738bd700c03bee96f1d14543b98a3d250acc86aa03bc3c529b73fc9b

Download Submit