2f9428fcf12b9d8a677d433062ebc720e6ae7685a36184aef06b91e55833c890

Analysis

max time kernel
128s
max time network
160s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rev_3286/AuditSettings.xml
Size

1KB
MD5

9a36a7410b4ef98b36da553e050b9788
SHA1

4ba6e5225a7c5daf30f4947b9288b708e8e557e8
SHA256

ebac316580540b7ee8e399f890470527e456f2c6a103fcc899f4b2442d8e69f7
SHA512

7cd81f2bedde51bca3a1f5a0889870be71ef521e5c331f1c8ba4ce97bf604adfff6cafa0fe707ed55df62bc340c45baa189e3d07f20a466ee7254f3c6abe6b74

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b0210000000002000000000010660000000100002000000066dde6e1787c3e512cc02384ab1e0e2e5f3ca82826f678bca1a336c3ec421ac7000000000e8000000002000020000000511eeba6b5aecd150389576cd0bca4621f0bf7132e5384a314a25bfd60c4feee20000000fb4f42624d7ec2a18f164e3342576aede63f1ae54c6209d32c3105e32c406bef40000000e57723f8efe10d5947150c46322507eacb03fca3aa6a1d7a15738724bc56c471edcf0b4347f27b7b6a11432a9ec04de3be5423cce44410ecb913df68d5a94c03	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21604B01-28F7-11EE-9706-CEC9BBFEAAA3} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396840212"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000a91a245807dbb55e64923ac05a90f1b71be21f2ff32077b5161defb071a9a804000000000e8000000002000020000000853aefc995ee25afa5434406f42133604e9f28d82db15748994055c6ff223458900000000b9acd43d5786bd3aef8c8603903c54febe29f2b8bfe94b9ba6f88dc38e027484ef0db4b6fc7b8ec226712ce04b2c40f4b51013e62d424dc80bff8422c8d2acea7bdaccd0b66dc502bdc497c160250ddd0fa49d708d7cafceb119e27b9345c89f41079071ce4bf743753a1b27a198c94c794b9991480c4c703715070722a6255099780c990edc2371714a80c0810b9d040000000d3f6b9be503571ed2900ea3be8432b75d6e49f13b2d1e9620fe2563fa9ec13e3b5f95f0d1ff97f027f1362f2150fc97ea539d9d137c58d514731117f9d4036cd	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0711af603bdd901	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2408	2600	MSOXMLED.EXE	30
PID 2600 wrote to memory of 2408	2600	MSOXMLED.EXE	30
PID 2600 wrote to memory of 2408	2600	MSOXMLED.EXE	30
PID 2600 wrote to memory of 2408	2600	MSOXMLED.EXE	30
PID 2408 wrote to memory of 2504	2408	iexplore.exe	31
PID 2408 wrote to memory of 2504	2408	iexplore.exe	31
PID 2408 wrote to memory of 2504	2408	iexplore.exe	31
PID 2408 wrote to memory of 2504	2408	iexplore.exe	31
PID 2504 wrote to memory of 2788	2504	IEXPLORE.EXE	32
PID 2504 wrote to memory of 2788	2504	IEXPLORE.EXE	32
PID 2504 wrote to memory of 2788	2504	IEXPLORE.EXE	32
PID 2504 wrote to memory of 2788	2504	IEXPLORE.EXE	32

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\rev_3286\AuditSettings.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84fa371d0a0e98463a149c4657f8a8b7

SHA1
0c3c3c7d9792e8908fd0ad47172debb60fb501e4

SHA256
d1ed0f7c6f987fee37ee2eaaaa46b6fce251c827b6d54522c9113100171eb03b

SHA512
ac31330d124cf2404e4088cfcb8c023a2138fe8d6f411d6ec9ad571707960199fd1f670b7f2b5774160ab629606f93a6d03ed7dabb68a2c398e6bd0de9549077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ae487ddc0ed0e9e44319b943d12b62

SHA1
02fde60044e40bb4a91036f95ad39b8a12e66812

SHA256
13f382b7f62f15dcb3bc8648d3de2396ab8f7040a4877be55a9d4141e1db261f

SHA512
4a9891ae43723da4fdc4047ed9588e9bdff62a9768356404822319b3c424b39b1b1dfe5344f25121217af5db9bc3b1fb44f9725f5fa1c88da6870a32780e876f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244d1aa7e743114b8ad6ccac09e370d6

SHA1
15787fe7cc785f495033dba08d9b35e3c5a63fc2

SHA256
1e869f31df48fcb5cee5fcdf4120fe6f05cf2e82b33e9a3f0df7a05f2026688a

SHA512
e6214a0b46d9bc27ed659af66bdbbdf13152431ab4a4a06ca5f7f656c1175fda6cb92a5ef1fe3db11ee0ef3de97d32e2c6d540d5b7dc0410413619293f632c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21007657f35c0daa5e1b8b264ad43198

SHA1
01993026f6e5711c7b400fe5d23d0d40b20a107a

SHA256
133f578a47114fe310616efd00ade258ee914418f6ff0af03f832df4d43a0df8

SHA512
608038ee78303a77da1ec3ea2d05ba63182c23b0e19497d79de14d103b4032f7341828cc92da87bf3c542d2ca69807cdf6578b189193da9373c221e841f9acc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e33c2888af1ffc48aee416d98647736

SHA1
deb899de12252e3c5f26ffceb76df49adfea0994

SHA256
e6b1d58ebb95f9b6dd4c2fe386e6a05363ea616252ef7df964e96a3aa1295e37

SHA512
d19b0ae1fd2212f63a689ea497f01112ae2c35e673bfdfe83c80c60de9fd6796069d17f44e86ef185c0d14a09e38535e090a65d257027ba15e5d8058bb2c405e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bba875ddb59eccc4b0e62ba52b88ac1

SHA1
adca4d130050ed0f30a09fe901bbcc603adb33fd

SHA256
e8aa473ba9dfd4c1fd542e0245025544be076328cfda58d43d32b36e9697bee6

SHA512
ec6eda255652cd272f21cf55e5bf8ff42a2513ea0b98163b3119e0bf9d32eedd0a2a5bbba72fcd2f2fb9b5a4cb12924521e94eb470189727102fe52ed2e84d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2e583103b30e3834b555f9c60c18f3

SHA1
8046e23ac6c70951ff3830795d0a464727db725b

SHA256
8ae71f41776605fdb8a526a2a19c2e794219584711b1e3586a96ec55026930ee

SHA512
f63673ab2a7672ea144dd896c2e3f40527e9621bba473e15d78b01439ed7ef3e0ee742da4f6098c2f505a36f121e6b660b0502f48493a18b2598bfc0d7cdb46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cd9596675340d7b9b4f64ccf955e8d3

SHA1
cdd10f3e2e1511754dfdeb20d311239d28908e91

SHA256
e0011f97168677de8d66d13a99cc9d6dbc84eac206002891f02aac3bb46cc641

SHA512
1ee93f2864a2579a50d754adc5ca42ada96c79896075056110625ebdba0f06ea91cb894787c18571345208fc96a42c9dd18ff25eb97e114d43b4e4ee5bc73aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627fc9c04457f915e81dcf04d49de036

SHA1
e394dd3643c392bdc1df86542d411458b1a6bfbd

SHA256
a10f3fab0751c00a2adc15ad3452f278c26618a1706c84370b4913d3ef03270a

SHA512
5a22b8b92dc02a92ffa1281e36a6a215dd289760b09110a4bd4d8e064d586ce2b21efade169167d6aad71a3b10bb8dae1d65354ca6ab999cfb71f1e6d3e8c882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2UNMO2B\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E3B.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar408F.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O8Y9CJMM.txt

Filesize
603B

MD5
78e70b543fd3aae8d0499e7c7867f54f

SHA1
48266c8fd7982968d7b0007a9f07e191fe07075c

SHA256
74570ce3ccbce569a64784cee5df1759225d13e21d5da98598be928d45924038

SHA512
d016bb02c1d16b0d44509df42eb306d59116d583c099e8d3404747296edcde430b8a057df3e96bb15410c23958aa0703ba4fdfb78a9898e70c88aefd395f4b09

Download Submit