5dd8a02a0d54e2390aa3a703e8776c94e23eba9128edac3b8a4c41a454abebab

Analysis

max time kernel
138s
max time network
137s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

diabetes_reports_local.html
Size

1KB
MD5

82c943f3825b6c0ad53ea5a928f545bd
SHA1

626e445dfcd1c8fa70a3ee779b6d9f484e36cceb
SHA256

c108fb2c8544a1f2faf5fb450db095df0231cd876aac67e944325bdd74bd3ddd
SHA512

72618f9545d4533e9e0aa6adffecc009928585eb84950ba2b3d3e5610e2ae20259f2b39911bbeaa60230a490e8ced334b0b3fb9501ffebfc930ccd3cc8b27cee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601960"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000002fb832321d0ea0da63a8820eb2bca4556139adfeba864e2032d4e3d0a830a5ec000000000e80000000020000200000008a2f5cd24b34a72ab2d00f8c12e32ce9f20f645e2793a3c6e3f2151de7af754f2000000059611d0daae8e51051fa6920fab8cdb3dc1a5a5f5702b0446a9650fc4411a894400000009ab6defde3425ef12068c917cc82430b71d6d08830d369825068c04e25cd317f9f1866b524ead2ebf74c80788482fd67c3bf9dddcd0707d3fc9407cc45816fbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000779992fa3df8b5aeeeb072c5cddabcee7fb9ad8811965b264c5dfb98e52730a6000000000e8000000002000020000000dd3c8329abb64449f92ae1579f0f06d8fd824f57086f8ff378c93739d184c56b9000000098579d5d52930819d1446afd846e166b08944213bfefe97aaa3229acb7ed725623abfb11abaf82fe4035582c6123b42b5cbdc3c868dc4fe38a7d21a48c4c35ac71db092e6a1d6a9b0201565069dccfae7500007cfb77038cf6be6de8458e5c02b3da52f4a3b1f26cbb9f0b427c49b600960896680d1731dc51cf4f70b2921f4181e9f8d38bbab25a8765a74eee57152340000000889ec8a11af92e18caa6e27c0129cf1758ccaead044179950090fe69b6583d2ad8321251706499e5e9af02e7c121f8934e668f518798ca6b0fe0f1e36eec6fe8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC27EC61-3560-11EE-A944-EE35FE5859DE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b031e6c06dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
2564	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2564	iexplore.exe
2564	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2564 wrote to memory of 2832	2564	iexplore.exe	28
PID 2564 wrote to memory of 2832	2564	iexplore.exe	28
PID 2564 wrote to memory of 2832	2564	iexplore.exe	28
PID 2564 wrote to memory of 2832	2564	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\diabetes_reports_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcef3ecaea1aded62d8a15eb3afb0b90

SHA1
ebccca98a04c7f4f61501e6846daff9be499b0c9

SHA256
8981d4bd92d1a9eb659ee8f80cf9c5e5e4fce4f0f668b04bf428748649056d50

SHA512
e730102a44e2cfe205e05fe6dcd82ed3663c16db1e0b5db7bb81d0f75d4e6c43db06ab060cdeb55ce252965a8fa8de4f026c3aedfb1ab28247ce00912e96dceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf6dc5ae962656ac4a9c15388ee6b14

SHA1
d73e81ec96f0b67b09724035d797a3b0abbd5592

SHA256
aaa4ee5722b1317b388e02708492635343b343c2877dc440faeb234380f1a799

SHA512
f53d798fe575efd51f836b877ba3d188146c5833b8daabc11f55a6db33f441645922c88fb9a4247ccd7fbd61b37f7da5c7d5441d81118b068196d938e2031154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c2840923a94bb08fc54a71ebe723be

SHA1
e79d18b2d8f6b1893d9adea6a510f56618fc6191

SHA256
75056ccce74967062ead6b7a7c2b32693567f32899498dc87af27bf43609d1e0

SHA512
0162ab4741c9606abf5532e7db416df66ed31c0656212bae23ce8def0f6ba676be993c77580d33f7aa863076904deaf0f509286dc7ea3e86147f84f084da78a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693fcc71fe6aa6ab953c7b946f6a394c

SHA1
9403e1a266f92692e1906db41988d7d4ccc597ac

SHA256
d8a43940c1cc44e75f2bdc803b1b7a785368a83224bb3909072a0dca5a683022

SHA512
d6979c475c72f58c449cfe487a78ed83110e864d7a4f71915fb38392eed912f94dc0711cd80d257c4a2fa0d5fa23c08151b32f6e5cf4bf4a7406af139fe9bbfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65ce8120c9310e47bbb7920beb069dab

SHA1
43f50179de3661408af4ac19da298575a16721e9

SHA256
ddc0186bcf4ca5a68f0dd989fdd35afd0d6ffdb2282ac01734763adf033f4513

SHA512
b49b692ca4e26f299d450d424c607d6a441ae506598503c0d77ea8c81e6b3920b30e8d998388d3a6850e63136c3010e4e367ec32580364f276d36ddb060f8708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4efc94a1cdd5d98621164186a565586

SHA1
e9011bc4c5ff6eb87d7a242a7d0364b5dfc02ab3

SHA256
5137c3e8f73a9927c88d19d6faed0afbceee4f672122f4def46cd07ce739da48

SHA512
f8b5a0e0a062a8e13bb125ce523861f2584cf3a7dbb0658e057b424b21cdf55102d557116ae9fe0c3ca910a8c3deb12651891d6338bb7c963965628e98b1e965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ab792d6cf148e759ef0e36c5c61726e

SHA1
742f7db10e7cd199342559319812a83d865de129

SHA256
efb370f77cb0db4aaa23a45c3e5c8de75aba84e5a41d3fb8b2ee645d7986e1ba

SHA512
90f6a66171edb4887b09d87fc0a5f5be157e1552bad6e524f6ca9fba8a79170362d7d8c83fffed4ef10f75dafd23516a4de75d17dc2d7719caf6bce16e3b3475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890adf9d59cf6314bd77ac1b6702f5d4

SHA1
03a10aff32e4db22f189ace9c0149d272b32dbaf

SHA256
e872f10853684c08838ee70abbe27f5e57a0b0e54cd21fe2f0c7f2dd68bbd547

SHA512
320f77359daf45ea6450e4f03cfb1850c4f322c29f7fc3a142ecd2ef1d3119810f79a60af6b03411745cf827b88379d77426d2432b9107ef46a7746be67ebc2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
475814a62d7a6d5164bdcc57bf9a5ab7

SHA1
2302363d9ae0f2ba89670eacd93356cc431ccb3f

SHA256
d90215db42d3daf10518d861a5cb6bf8c6c5bba9e92108e8e1144592f3d6bd6e

SHA512
0b67e7b12ea407a390901ff915a4d879f1dae7fb415c6edfb0f7a3e5a156568a2def1597bd551c86e55f091d0da9992c1d56bfcc093b58f09517d96a735edeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99bb54e4025d54ba002f4645c37a49e

SHA1
fc0734dd2e54a7d22a9e26a04e110dfbead41c32

SHA256
20fc413c39c9bdde6173929d54becca8facd3d8047879c6b820e4c877a245890

SHA512
efc0c6852086ce7ddbbb0301f5f846bf8754ee95c8bc7099ece8abe66a16667ccfa268beeef77eb3363c87c0c9da73cdb81780d7f83b0fe30cbc8f30aff4495b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB1D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB3F.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit