08b9beb19ae13d5ac677b9eafb33d1cc0aed628818a70ffa05ac1eb8d6ba5e22

Analysis

max time kernel
135s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-07-2023 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

machine.xml
Size

33KB
MD5

0869544722561f5aff0eefc83fc7b001
SHA1

1e118f4b5c1c6a7b1858e3fccb1b1d1095561976
SHA256

ef9b9387168fd1dd6c996f96c134d9c44f8eb06f9587004bf997252a520182d6
SHA512

ced7c9a5363cabdb87b01ed6b4ca190a690640dddf5cbcc0438acdc611a8ee942cb6cd73c78d3fc2d59f70171f22ac832a10b1e23758dc92599ee24acd978ac2
SSDEEP

384:PbtltttttSRtNRtcRtGrRtSRtTf5Rt70zDgRt2Rtuj4f1RDRty6ugyunHMSeuWuh:dkn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb00000000020000000000106600000001000020000000a61527b3f608b01d8f539b7057994c5939d481011bef801d69a45e9bf1ffc3fd000000000e800000000200002000000098708e1a36aa0c46e0c1ac68274e8ddaad9399aced31bf82c6b31562302657c990000000811053d01d16dd04051b534c4d41612e6a5c8acb76678df146e6841abecefc254f1e75b31b845b43d09fc0b591c8c927c3fd7071e23b66c81c4d7bb750b2af934a1d03a04b56b2d4db32970b5848aa17c0194f49caa0363358ec80cdea68703eeafd56246eb61796ea5a5952365653c7bb1f9de9c70388a7c3a63bcaf8e0d0fe008d00f7614dbab32b05d3053703c6bb4000000089316a8a983a5ba44fd42ec76a0dc1367befa8c02c997f14e5af1caea28cfd66259f940d66124f7e7a1ce658b7b6511d721d2f6021fc9e654e7ce3a02f961316	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a383f273b5d901	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000019950220b8858f16deba0d13aff2c0a433652cdcbe30a9f471539345c3219f52000000000e8000000002000020000000cd3b9e2a3f698389a7c5764bc8efab2860422f0f759385bf8e31bc84447f8b5a20000000a022b239551de5438fec83b40328869f4a93cdd934e74d75b0b9683c13ae3771400000007c963c43c2a1dfcd2018a1fc80b7caa58af92141721f5ebd94f8f18a3e8239d231136b59f154082c80581c74547320d336308b35e12f69ca33ce0b3ded5fa253	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396008698"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C7E9571-2167-11EE-AEC3-724B81B1CE5D} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
792	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
792	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
792	IEXPLORE.EXE
792	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3000	2208	MSOXMLED.EXE	28
PID 2208 wrote to memory of 3000	2208	MSOXMLED.EXE	28
PID 2208 wrote to memory of 3000	2208	MSOXMLED.EXE	28
PID 2208 wrote to memory of 3000	2208	MSOXMLED.EXE	28
PID 3000 wrote to memory of 792	3000	iexplore.exe	29
PID 3000 wrote to memory of 792	3000	iexplore.exe	29
PID 3000 wrote to memory of 792	3000	iexplore.exe	29
PID 3000 wrote to memory of 792	3000	iexplore.exe	29
PID 792 wrote to memory of 2936	792	IEXPLORE.EXE	30
PID 792 wrote to memory of 2936	792	IEXPLORE.EXE	30
PID 792 wrote to memory of 2936	792	IEXPLORE.EXE	30
PID 792 wrote to memory of 2936	792	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\machine.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8cdd13181e61f78317a8e317cfd7bb3

SHA1
dd1dbda39235a6c974daada8262edcc39d0149b3

SHA256
f5fefcee0d8ec830333b33a638eb6401a1e80de872cfba3b530a9817a5230d76

SHA512
80c696f454f35b14edf2a216dc97ceb8cd8f474247b27e3b4c7daab68e20412ff452675f47d8ed20a8a32aa90149739075c58113ef926d9de36aa6f414dd30e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0250df0bdf9302a0324ee5f7428c6e6a

SHA1
60f524993d9db51edcd6eb14e26819d94e9556f4

SHA256
4161c2afecad716132a7a38a247db47de4a4adaeb1df01c6ef172b8283aa7490

SHA512
a1a905f0113e16354a2751a077e15f4bb3d952c5348c6236f5550559626f83bf7603be7f0dfa411e58df50aa3c9cb3592f7fd54e03d280ead10948260e27ba48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa5f20751145a852780103119bf59b6

SHA1
7011e4894ac8473aac30b93ca5b2e41c4fa4ce29

SHA256
af22013a67bb77bdc238d43a08b4b1d14178ddcbf1098f1b87874221dcca83d8

SHA512
05344aaa54504e25569b86ab1489e073fed77e9044c872f7cd7fe1b3307a70772cbcb30f51cf54cb706255b6ba53318fe4199f1cfec49358041accfe01a9f8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0745bd56d58057b2e9216af6689fb73a

SHA1
58ef47ed1b618527ef0952292d5ddd4341ad1960

SHA256
bf2fc40e10aeaa02a6f289d6c18d1b6c4b93693dfb0df22d0da2ecdb6df37f00

SHA512
715e582a4c27f76992e2b00c76b5d8ba28fff6e1e9f6e14ea1beecb904b96e9f688916a48ed704d165b5f81a8a39d24cc6059f18d1b13b6406118ab17d95164a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957bf00ce83160170ea7933f262df6e9

SHA1
4c31bfd261b9d49e9b6f2c650a39ab2950fcc543

SHA256
fb0c43524edebf0a4aed5e53e19aea2dba4599e8bdaa28764af596bf508edede

SHA512
e33c8f5c0f5a3be79c4530b4f479be347eb72577e2dea51f167653c57a2705fd5e216f95d13dde4dc881837e880659626a4e234f81879ff0fbcc634cc04cb343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62065693e62b46e1e0ec5d7953985153

SHA1
07bec6f85f0fd6941c1f0d3499ceb31312ce5b6a

SHA256
2cac7ef3af360f098e95250ea84004a97647e118f847aed2a3df42be9c660f9a

SHA512
82906ff65c69b70623f650e11db9af2866f56d9933f93b7eb7e1000e9da5fb4e0406676ed237c540815f837aaef74dabcffd09a79edb32288d2981085515b504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
969c60dab819336252789b046c734cfe

SHA1
34defbdc65e886bfd996afc39ec922c53045e1c4

SHA256
921b2ba63ab180c187d91c333911d46b9141dc09b2befddfce2da6448f63cf32

SHA512
e683e947db86a0fb0ec7fc0e7c31cd5f7f7051061ec0b2d9a86a30e2f085d358f85e1939bd5159a57be46db9f491eab16a03290beb454d9221638ec30ae77969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9EM1SEHQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC8D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCFF.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BGIMPP39.txt

Filesize
601B

MD5
edb57aa0d0d15f0b100375557bfc03b3

SHA1
27efe6a25e09f9c8477fcf1285f120f8350b161e

SHA256
9842d5a576b9e4d35d6874e29cfe4cd5943efbdb34ff994f4623140e98084af5

SHA512
1f95270269b5f4ab9cd47aa2755eb4488093a5b82924ccd1fff9e91cf42569f6de825e5dd99f91008164297352e5a1605a4b7c723d4e8beaa7fdc59f19a94184

Download Submit