f08130ff8f580e3bf902eec1400af45854341bbb5ccf00f669092efc76a076fa

Analysis

max time kernel
135s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-07-2023 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sticker_circle.xml
Size

1KB
MD5

836c67c2afdab7826758b8d785916cb5
SHA1

fe2d7d0f436c25c4b51c0027a5bbbecddc75780e
SHA256

865f14103bf126ad3482d359dc374addb4c9b7556e19e503c64105abc74f774d
SHA512

9d504861ec66ebe7f5a6680c37c6903509333ab6feda51e2af60c397438bc91b9be12f014e6a169db9104c236748216ee18e7106c68793a8486fffc1963645cc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396328665"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd82794000000000200000000001066000000010000200000002373a4293edf9717ca50dd5134a03dbb3a28af8d458c83d67167c42d1eb5c386000000000e8000000002000020000000b9055b5c884be67da523d73bbfc4d2849d501e4ca9e815ddc7e84fd8fe63a1192000000085d4ce6a50f1b0f771f1072147a255a933a0ba9e013c34affe3790d0d749d09d40000000b76013433c31698b77754d61a072fb951742e77246553205039f7205d5cd5ff929db7fbd754d8f298f8183698e779a9e5d086992f2e320477636fbd8073c8483	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{177D47B1-2450-11EE-B6F2-6AF15B915EED} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000fba069a255419424860bd6ae7fc31c1215ddf855504fc59507b1027c43e10374000000000e8000000002000020000000e0e56c654c8e9632c22fc83c8bba63ce7143863ff166f6d1cebd907c9a9cca7090000000a62ffb11b6896c2bc97d4cfe93ba5f5f633b724c1b9f8714463388f01a746395c4f09532392ca32d2edfee4725ac01548551d7c544dbc42e5f34f6a6b8ef3a2bc66665207f2d90d362e2dd90c9aaa2ad41f7d3ac537e5089aadc58a94c1b993ce47fb5a25662ae91043ed070c407d07067c611843175e7e5676c182d133a1aeed7cf7f2dd264e2257790f775f91e1b4a400000004772e139a5b3195720bcd43f49dfecb4902cee8681d36c0536258f9b3539fe6b66ba611015782f5d7ffac2129cc5b6dcb55685dbfdb7b97ebdda8b2c38c7f2f8	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c006d8ed5cb8d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2172	1576	MSOXMLED.EXE	28
PID 1576 wrote to memory of 2172	1576	MSOXMLED.EXE	28
PID 1576 wrote to memory of 2172	1576	MSOXMLED.EXE	28
PID 1576 wrote to memory of 2172	1576	MSOXMLED.EXE	28
PID 2172 wrote to memory of 2528	2172	iexplore.exe	29
PID 2172 wrote to memory of 2528	2172	iexplore.exe	29
PID 2172 wrote to memory of 2528	2172	iexplore.exe	29
PID 2172 wrote to memory of 2528	2172	iexplore.exe	29
PID 2528 wrote to memory of 2160	2528	IEXPLORE.EXE	30
PID 2528 wrote to memory of 2160	2528	IEXPLORE.EXE	30
PID 2528 wrote to memory of 2160	2528	IEXPLORE.EXE	30
PID 2528 wrote to memory of 2160	2528	IEXPLORE.EXE	30

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\sticker_circle.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ea4b4a71203b0e8e1e540737dd1242d

SHA1
a9b1013860ddf645f5c1dd7c28aff9c922953297

SHA256
941079246bf1333212cd6b613d9df328effa90906a3e2688e1d318d0dbc4737e

SHA512
f2a8a6f592d4c567e6d0f4534ee89068316809ff509f161c88f210a5b976446771d58b948b9092d7c9970bac84bfca8a1ec1b118031c7f570b13d8e661991cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a54d5524eb6090e2bb3f0e3c696415

SHA1
e9737e94d13a835cc24c3c9b606a4d8b0099a6f9

SHA256
e2cb0005327a831039ffb86d48067819478ad7ee43494175330c7e252e882cf7

SHA512
79c9703c371bd89bd92cefc0cb7b7e92dc0ee0c950dd9ca69d201dcdd288faa6677b171ac1183d6bd1714e4531916312d3adf1d13e61f3352c0aa9f5f589ffea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a289ffbfff21910e21b044ed0b5981b9

SHA1
6bf9d3e580f0ac09a7aed3ab75b2b6475d0c53ed

SHA256
b05012534461998220c72fa27cfb54051ec00a4ad46d33be2e42b1b5b8b8e988

SHA512
728774ad74cc39d85ce2c9ea4ba3777063477587cc0da8418e24833b0345e6bc2a170defb9b9479a22d4376c2e9f03574ea689bc5e98af059ebac4d246cad593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b45c5cf48e7f9ff3fd2f7c3d5e2f8c

SHA1
970f93587b9cb062c8e50d645c129c61046a5c5f

SHA256
32c631710a88e1966aa507abe0ab2addf0e4a06e0989cbb12c821c5f81e33ba9

SHA512
3001926ac93d633f3875fde66296493aead5e9c24a88e2b71ea2c6363082c1efa6b42cd5ab3b3d123e9822309c4190ae9856390238d723cde12638331b7eb3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5473aee45f795e74ea14dd8698a4a44c

SHA1
c5779275bf839e6cb775c0fc02d6813fd3ab9819

SHA256
21df93e9895cb06961b22ba4f876856d2734b2f8c7aea6652f12470e68bcd858

SHA512
91ee3aa851cedcc3d4dad1aacf430f4a6f68237f667710f1f4a2873d1b1861bf14f28c1321be0edb2159a70cb435c13bd54934a91b2a397ce48fdbee6c17c078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b22b74e8d4761fca3588be51cd9057

SHA1
b72a312c19370b5d4ba7f0e1bc125891db2ae8c2

SHA256
955ac22ae21dc37c3540c2ee2d097a4d5317baa9eb9fefddbf7f37a8c13fa6eb

SHA512
ce6c4649dfd4018eee07935b69cd502f26edc0891195c458a75e198eadac24f457ea1f2576efa127bb229cc2d7976933ec2f7e5ac64c181f0450c05d3a10b959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d5f37243218f813231ba3c6e910da6

SHA1
7d6a8d3a300fb2eae4d6922855344ea0eac2c7c3

SHA256
5ef8b82c9ce4945178dadc2e24d215ac59bb05f28edc2d2221697a6fec143440

SHA512
7021f7c29b45571b90d9bf1e9f0e8f812799c7f2153eca50eb835f9aecc0f14b7096b95af8930f01338a15365f3dc51922cf8430f08b7fc617ce679883843b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGCFYHZ3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E7.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94A.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EKZY3O6E.txt

Filesize
596B

MD5
20bcc7435cdcb1152a66a30d04dd62bd

SHA1
7e141af9634a3929330804674ea3b03bf316a5be

SHA256
6d8ef5dfbfae6e5cc71c22530dce444ab23dcf3fc3bc27d2bafb48a7a662f603

SHA512
384ee7626600a35e91a97865ef1457c6ced005a9a084e6d1350b6220dadf554c3b080f0dab776bb520d83d3ada5a258020f53eb1f87be69c6fa9e91c73df9282

Download Submit