30438a48463c536433c61446a1f8e874ad7ba451180c1bff69461b2a9d7abdd9

Analysis

max time kernel
118s
max time network
165s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-07-2023 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rev_3286/AuditSettings.xml
Size

1KB
MD5

9a36a7410b4ef98b36da553e050b9788
SHA1

4ba6e5225a7c5daf30f4947b9288b708e8e557e8
SHA256

ebac316580540b7ee8e399f890470527e456f2c6a103fcc899f4b2442d8e69f7
SHA512

7cd81f2bedde51bca3a1f5a0889870be71ef521e5c331f1c8ba4ce97bf604adfff6cafa0fe707ed55df62bc340c45baa189e3d07f20a466ee7254f3c6abe6b74

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000dbb23d46cd3f2a6a1b289c45d7332ec227d46aa5e7f12a61fe700696f817ec4b000000000e8000000002000020000000d28166b905e07a21b11fb96d01b89d9fe4f4251cebf0cc11db660a84a9c88ef090000000d66daecfc79585bb8cacdcb815dd3dd3470aa7619891b7bb0bb2dafe9f309bdb8b0d18945b1336520cca9bc42b3ecfc8d7ce0b1936f86da8117345281fb34aeba19fd62caedac56530c5b1368740852e192e18c43e7fca6f514205e2b3eaaf2ff1a14c58bc789c8fb2a6dd75fdb8eea0575ab8be8cc5439f657977b362156a8c7d2532869bf91c78e08d943470bf639f40000000a4321078c95292277fbd98f63d25d84a891aec8462cc5b15fbbc12bf503213c1cda43f0255a6d543af817f526cb21590f2710648cab41aac6e878e787b8b568d	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f3dff1debbd901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396714362"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd82794000000000200000000001066000000010000200000006b9c905a7b63440bdfb7b2ce3df3af226f29ff24c4312b1a018d531f8566fa4d000000000e8000000002000020000000f4b0dd18faee8bae221baee5ebaa00135f4486c94f9d192358d311b8778e1ed7200000000f8ad21403c95e3bbb5939e430719f6422a0eb8734dc89d3430f184fc2ccf1c140000000f7dd9f7d9ea2ac78ec0c624baa572d697b2091b4f96284469900a3b8e927d82b26e949a07d610dbed6ef4fbf0f9472db5772dde6d365381172cea2dbe4e9c1f4	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D25CCC1-27D2-11EE-BC5E-5E6847EBFE3A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2412	2256	MSOXMLED.EXE	30
PID 2256 wrote to memory of 2412	2256	MSOXMLED.EXE	30
PID 2256 wrote to memory of 2412	2256	MSOXMLED.EXE	30
PID 2256 wrote to memory of 2412	2256	MSOXMLED.EXE	30
PID 2412 wrote to memory of 2152	2412	iexplore.exe	31
PID 2412 wrote to memory of 2152	2412	iexplore.exe	31
PID 2412 wrote to memory of 2152	2412	iexplore.exe	31
PID 2412 wrote to memory of 2152	2412	iexplore.exe	31
PID 2152 wrote to memory of 860	2152	IEXPLORE.EXE	32
PID 2152 wrote to memory of 860	2152	IEXPLORE.EXE	32
PID 2152 wrote to memory of 860	2152	IEXPLORE.EXE	32
PID 2152 wrote to memory of 860	2152	IEXPLORE.EXE	32

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\rev_3286\AuditSettings.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6573b31d5cf6ce1d03ae841e0bf93ad0

SHA1
453174ab0e55b36c54e8df432d191bd5913d2126

SHA256
a140a2900ddfaf9bb36a87775600feaee21464837eeb459f17ce0fce6411c2dc

SHA512
90d718a40483916c60c9d20289ef290ad947f13f894164fdbac6e559d24c1ccc2c0885ce6594ab5942007495ef120dd919bee1b0e7f7d24fd25cb2ca011121f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c853361c31416984d71e78b7ce66d8f0

SHA1
237c651e2e734625f426c7d1c17cbb9e235e69ac

SHA256
8441608b2bb00fe90a72eb8ca6a2a7189e5eb504843686b1f19d08ae0f722950

SHA512
d8d6802492be79f85db51b090493fa9eea15b500ca012f346d7c5426c402598c07c37e6dfe3e94e16b39224e817aa4e1689f284fa15e8d8e4c8b3730f702686b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8347fa7dbddee830af993dbc7929ec7

SHA1
71ae5dfaaaf0beb60deabe0e1b971b0a29e233a4

SHA256
32faad125a76aa920f5fedb9d68bf7280c1bb812187d335233be6403bb71935c

SHA512
8b7de6767b1a60e34fe1d60401f7fb28c3723a0e7c66e5861ba60ae197bc821bb8235d4633cb9cd50435487922c71a1579b9825a742610293a02df8b6ffa934f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0fbca2c8ff906c88b5a0effe10d1f4a

SHA1
576869d1a8c10e556d1811eb17201aacbdb76975

SHA256
4c3e7c4fb91b6220f7dcfb343f58caec19c3eceaa5a3edc529eea118f5dde1be

SHA512
21b99842edc69d7e3814e3188a616a6b0f925f9cb594835cc6c134f0591f0f85682cd184aec3b950796770b1cc0815f6a2309f815d52de06db218c966b6a15d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747a2a1397092520001969f68a05e836

SHA1
04c4d35133ca452fcd7732265fa2496e15344627

SHA256
cb017f37bca307cfc134addf269166acf5e1f3ec47f453dbda06f6961ad25ff0

SHA512
b1ad4e7e9f0d780161821ff15c321f00395611a2a5a1cbb7cf9a3d32167ee66d0c979b195dad3acf156a8f0320bb75c236374efc92732d581b9036d5db2ea0b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2cf77f19611f0639e9ed6ad2dfd6ac3

SHA1
e6c3261a45987789661ac054d2e02b5c99f2d791

SHA256
d7e761e1432fb72da8fc2ca942c3e8e3f1eef7c676b95951ecacb9d3b6ac13d1

SHA512
bf46c3524457136d9b35ad0d8e0365836888a26ea6927cba79a22f94dbefa9a00681b341fc5fabf14deada8975f3c8f17068f86491a9b5031781c0708c0a1f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c88d88626563bb13d57f6b6a2c6a10f

SHA1
19d64d2b2c7678cb87f37bcd6b5e35eb772211ed

SHA256
713578558006c4f08818cda2233c1db674b3f3e84780926cfa16a0dc77a43e5b

SHA512
c9e912de71288bacdac1d3726df5ca9a40f51ef979b9be943e3dd41179cd6c49036a2def4bf8dda60616bcc2323b259274732ed86c629ab683e843d0aa197d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19c07670a0ebf4349ac72b294534d99

SHA1
2f3035920e4fe87096071bee469cc01a3d845f85

SHA256
30b4457534457d99fb20a85c867b0911f70c59b32da2211680a9cf58fc69fb08

SHA512
5fd269cd2832bfc05c9b7282cb867f466aa48ec4c2727d0d0c4f641391fce2e96a04547bdc568f824d5294bd9fec1034cb8263afb0cac1e7f3ca09ddf24cab72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05d3147e21375a29c0e32784560d0e8a

SHA1
82ec70e1c05ad10cf1d9b631d00207512af53686

SHA256
8551ca8c6779fb30e80e035866b92d1c6ca5e576e93b6ad109bff5085d628861

SHA512
6f3876b152a933c970e120fa8603f9f0a25f045936c8f415a5ac6251918866167757a8f3d9289056e8ec41337e5c627effda17f747c3852e890f7feb057a1539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\12APMO2Y\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C51.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CF0.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SO0INR3C.txt

Filesize
601B

MD5
0e78e75648be40bcbfddb4677a56b902

SHA1
9f7b4c57ec872b1fb05129049d3ba1573e714246

SHA256
6717c5d6d1d8560ce7484bace0eb4b577f43535d667006b2895152f51aaf763f

SHA512
362249185d2cfb6ba4c2eff7c829766875d428aa24f957d8ffbc6ef710f56519b0e71127462396941ad8ae06f644513aaa83111dd4713eff7e485ee7a36c3b2e

Download Submit