bbe7f3bc15429196cc01935295ff6a7867b2fc501d1896b01afe62fbce2ed314

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-07-2023 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_1.xml
Size

471B
MD5

d088bfa4b1e206c8c5ed88405855f767
SHA1

1cc0925ff6a38384f466560cc86b1afcadbeb15c
SHA256

2f7924e1f2537622b8617a051765bd4fe57272e9f14a37f4bbe127269c522434
SHA512

d1ceda7c098a5934f1808d9b89bcb7fa8809a1f084e915ea0c12ee9070b854ae9d625eaccee3af3db5d50a07438eeb346b01ea73463fe5e34b988a7663321b79

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4018850ce0c3d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397594446"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000418efaa7f0d471a86a513353de38bdcc9fb424c522254085e34e81fb8d1a2c5a000000000e80000000020000200000005a83a1e159cb1d182f099e401843e3eec79f5785268dd1afcb8ec29f0ef24e3d200000003097eb419a24323f974f2ca42841e420c07b797c035b0c7a6c5ee0cf4c9f544e400000001c70e29c9e5244adddac9aa6d8dd2f08115a34f859d20b216f76122107ca5fea22fb242c2e2848625425d0055a534dca11340322f087e20f192a384a7134be2c	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37CD4B31-2FD3-11EE-9FC1-5E587CD0922C} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000da5ffb2771960140ee1a7d9d5e426d3f8d753fd961f8a618f4aea7452beb366c000000000e8000000002000020000000b457819d4ec0262d28bbe39c987bb3f86344a86f9711de81e91782d6adbd9bbb90000000d2a377d9dfcb55e02c3d161e38aeb0987f6e3487538d7f2227aca96b9a8cc06cc34f900c623a02f4384a7d983a5b6d1da12a8ac623e4d8da35981408341ec1e8e0b358003b2826f79768025df36da5617c22ef6b46fb67204598c8819b5d35b520f43c84cca39db26754446e7a1147268fe7ba5099e48e59c2d6f8d4953bdc6f5fe86605c7965d6f8702d7d089f6a3c340000000b45c9b0c8510300b1beb5369941c1d8baacdc50c9769ef841954fe07b2b5a11a70bb83dda1b34a36f43da045cad9ed21929753907be51ac2316b3a14fcb2813d	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2108 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2108 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2108 IEXPLORE.EXE
2108 IEXPLORE.EXE
2684 IEXPLORE.EXE
2684 IEXPLORE.EXE
2684 IEXPLORE.EXE
2684 IEXPLORE.EXE

pid	process
2108	IEXPLORE.EXE

pid	process
2108	IEXPLORE.EXE

pid	process
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 2508 wrote to memory of 952	2508	MSOXMLED.EXE	iexplore.exe
PID 2508 wrote to memory of 952	2508	MSOXMLED.EXE	iexplore.exe
PID 2508 wrote to memory of 952	2508	MSOXMLED.EXE	iexplore.exe
PID 2508 wrote to memory of 952	2508	MSOXMLED.EXE	iexplore.exe
PID 952 wrote to memory of 2108	952	iexplore.exe	IEXPLORE.EXE
PID 952 wrote to memory of 2108	952	iexplore.exe	IEXPLORE.EXE
PID 952 wrote to memory of 2108	952	iexplore.exe	IEXPLORE.EXE
PID 952 wrote to memory of 2108	952	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2684	2108	IEXPLORE.EXE	IEXPLORE.EXE
PID 2108 wrote to memory of 2684	2108	IEXPLORE.EXE	IEXPLORE.EXE
PID 2108 wrote to memory of 2684	2108	IEXPLORE.EXE	IEXPLORE.EXE
PID 2108 wrote to memory of 2684	2108	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_1.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a49c472bf2f84514933a3928b4003f

SHA1
1756592d115d164d00ccee74d4b92760b536f283

SHA256
7981f186007c2998aa0fd87f84632ae25fb28e27af5078de8e6567d1a4597841

SHA512
e10fef00ac545fa93f8d5497c63205e97333e1db66a8271c913ca125932120a5f1b972dec246546767253290a63ee383f762149e340e35a27f1c7b3e15161661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e5952ccf2e6b1aa2470892b5a11ac3c

SHA1
59763ba37bd1e0b5c54dcf9ba57b4b7d893281c2

SHA256
1fdb4ab5e2afda2a12373143edef5c0efc73ac468bcb278e21a99ddde9bb725a

SHA512
2953aadc14b7e1b82e36743f8a27bcf2ebe84f9317255d8335ce20c3536eb1ba0853c2496ef48eec1780afba7f3bac24d6227dd8024731fa01086c181b4bff47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ddb4400945c737aa8f7f8b60a21394

SHA1
a8d16b23153638249a9d404c45a63f3ae9e0d763

SHA256
0318778332c5cff6176d91bf4f9475210fede5a5d09520c31834cea5d232a259

SHA512
473aba520d386ca9d519781af0e53180ae9c728dd5bb21d1eca313bd08e8f5d797e9035b856b59215731978addb4c1da6ae05a20f90e72141be5e88e84fee4c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee52220231e68f4d86e2a512819d582

SHA1
b51dcbf47a2127610afdcbf4a580e3bd1d5e354c

SHA256
37634dff846c6af90d5856d9fc72345ae493d11385b8fe313fa9494b92edb680

SHA512
4b6e788cd9545f8531605077c88028a683f50b43e77c53f1102d1d059b97c18e30d346c3617d82dff3343441bdb7cf89db49c735df500974a4ce71528a897b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0f127babb43c8ff3a3d3e0b824823b0

SHA1
635ac84ff977b07a34cc9a0660c4a852536021f6

SHA256
bbc268877a1615afe80e34d4e8abbdc73320ba6bf48edadbe922e013b97f02ba

SHA512
177a6e553b5c7bdcf2ef08ff975b35003384011be14b0287df5a2acb48ae8d1c6a47f33ba6035a75d39292465e4f22d1bb42e39ce717d7beb1d6e5036c8ff92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f002bc91698371c1386f98a9a223f8

SHA1
2c71628f74eecbda6a7677ee91db406599da7233

SHA256
b0d246f35d17fcea96df3bf10cfbd893476c8264358d997e021fba807168f019

SHA512
8994a17e4e8f3d5a38359777b852974d2637f919294ceb263d53a6cc0627ecbcd10adc69527d3db8fb029984cac9c0f3b62170b16ba3660901f4c8c6561d67da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01218b7dbe944e8304adfd30303c22d8

SHA1
cc0c0020ea761d742ed978a867035c0b0ff14795

SHA256
541928ef7010feed6cea791df4ae2fd42119f5d11a98599e519f9f9e89d09933

SHA512
2f8e076cf8fd4369d580d8010e7e661f056592f65c019e7139d56b002ab680587da2661552bbf8636a4b25a9a2b99fe49ea0a1a1a27086e1058af475323de9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGCFYHZ3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE763.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7C6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HIZK34JB.txt

Filesize
601B

MD5
02a9ab5f48350b0894ac190a3ae15c8e

SHA1
df6f7db9f64a1ebf35b929568e663b543ef1ee93

SHA256
6bc3f06bfcced102c736866ff5faad85b814a18169070d8aea48a03aa31c5ec6

SHA512
b4427ac4cd41a7bd19046120000310ec949b3e961fab2519cf2d4abe5786777640b27745dedfd6e24d803f6810b009eb2df1ff6379feb83391a8936fea6e0aaa

Download Submit