5dd8a02a0d54e2390aa3a703e8776c94e23eba9128edac3b8a4c41a454abebab

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_insulin_local.html
Size

1KB
MD5

bd79c33de563833c2964df05bf71082f
SHA1

5de4fb1397af8410b28696572cb0e7260d266003
SHA256

a5e73c51212b21c1046a77882673f0c2cce8c5851f78ea6dd4924ca7d1ee566f
SHA512

5b3e3be332146401133d43574021c7cd28b52fe6660f5b6877b6db449c0ec208fc7ad3d4661ed4c88f63ee28dd8d8dbd2415bca40c62eb5ee18fa40040a077a6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b0210000000002000000000010660000000100002000000014c23cfcb802f05d3005050b195dce5652fb73e414640e1965aa88fc3f02b710000000000e80000000020000200000003da54c7e46b0b27471ce985582deb08d71f306dacaa5fb91b31f8bb6e58067d59000000067c5e9c6f51c144dce8805df609a640d384bbb0dc9280c2ebaf5c7a389616ae7c69dc1378346d66f09497659140d3ba5a835c511234d36274d095e58061957ee53b9870ae61006d8a2e1d0fdb9de189a20234654fc1f791c9daa79e08dbaf5451112bc5a4bf6815dfda6456a761410d05dd0689a6ba3f13c8bdf0b81cb7f9347442adb52bfb448da574e2bfd3bb342e440000000c759abf1fc4c8227ed993f1f43348c0ccafc5b10981226b6c19efe6309aea1c9f7e03b271c2b8373d0487124ddef3fcd3aefd99752d232d8f2ee22b025a35e4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e007c2c06dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBFEFFD1-3560-11EE-BE65-EA84BFBCA582} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000ef2df91c37bc71ffab4b4c4803c42b240d3367d623bed0ff6d3e84b583b16435000000000e80000000020000200000005a28eec9d05575c213548f3d1140700ee6387ba8bfc13d4bf444dfc6724dae7c20000000141d5933366434cbcfd8320e5823856462de960d4b818d68f22519f63807a96e40000000ef54386803d1e9c52b6c84139899948bf1613c58c604cef3f63f828ea68d0f671ced9b91849de5946e7194a24a168777afe0d53479c5ccaa8539da211b316483	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2572 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2572 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2572 iexplore.exe
2572 iexplore.exe
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE

pid	process
2572	iexplore.exe

pid	process
2572	iexplore.exe

pid	process
2572	iexplore.exe
2572	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2572 wrote to memory of 2020	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2020	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2020	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2020	2572	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_insulin_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b79d1b052e907ea2067f4c93d5336b1

SHA1
b2bba9267f1c6da181f856845e33ed7f37f1a363

SHA256
6522036572838cf7b3b54be80b058e4c4e4148d7b1940d758b8b5c538d5ab3b7

SHA512
7332ea6318dde12ee80e73d6d6fbe311d4c92aeeb57b373be7b1ccf20032da0dd1fe84ce917783e4626f30402adf8931c4ec6a2817e172f1e7e8ae17d34d78df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7994af76968b366664e8910721f95b94

SHA1
69d60b3a650409748b081decb45a9d24f89ad2a7

SHA256
6598976be06fdcc0e1f62480f30c2796f65104aad554d915c5c68d7a44b5de20

SHA512
e89cbabe9ac2f9dfc516c630238a6f5d579cac0966f851387551f27a0df0191c9804036e631ca957413469bab46b06f9849e179d96685822f720f310998af3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd220fdcb04d51bf05d9a355fec5ee0b

SHA1
1f5149d403c58d72bc81ab9d00d31bf041f2e297

SHA256
78052fed270ce38cd4026abff72d5e199f3d408213ef8b19ee690c34ddbce3a1

SHA512
f1cb36827a31c3fc77e0b78544c83163a3cd28baa0e87c427da1c2627650e89f7a1426d9a127d9ef5d68a05f9c4676842340e617c159fe34649af0ee8f6b33a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6d095b88e2046e8bc5dc95f5b7756f2

SHA1
518a90ac7fe7dbac9915e0062fc15fee776d15dc

SHA256
7f54595dfee21b26d629e27cfdc6356c541d965d70e6b0315bced8be7055ec4a

SHA512
532d7fe46f0dd862eb80ccbfef5e8921ab48b1cb26f6b6525271cfe9640094960c83383d2a9883ec7179cd1d0d68c4d6d7058c4c5274ed9323321b6249200d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82affa45d5c78621ba410c81e4a8934c

SHA1
db2d362814090e8c07d100c9acce90e4de17ecf3

SHA256
2dd25b615e9f5a31fbef30cddc314f640926386a3ec565f148c888ac85588f12

SHA512
a621525883e789b36e8b34e4648839c3cfa484a94c691df91bc5e9db22cbd84be0f9a360362ee19a6b754dd038c51225d463c2b5b18a305e01d83c28c949f1ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3435e6a3bef673c5a7477f1b44eab8b

SHA1
baffa74bba98aaed193df0a9eae75fd3e220d3ac

SHA256
78097f79a06a06790d0079f5624e03df10cc648d7ff7216b1979630f75b706aa

SHA512
60c63ec0dd641f9476f4c1f14b84361912bfe741139d7571e160189da4e4826bdc54a64bbece874523ee60671b18c41b5a784b65971fef7fa05d232e69a9ea5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3583b1245cebcfae4f544f342ab22cf

SHA1
a458e0a8ed28f4fd67a6fbb307fe1665ba6b4061

SHA256
dcd63e4bb74f2bfcbb907a53f05d13e2e38cbdfebe76ffc7ea2b566663c956e2

SHA512
f20a449c5f480664e4e452380d98b5c96545ece645467699445e3c1f8c70fdc1ef6ca64bde44909fc07c8711be223a1c2b6fecfbfc99568aad725ac58ef9fb58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10ea0623bf4fa613daf62025c7f01ff2

SHA1
f50bc46a4c481892e54578245c795cef4c981f07

SHA256
4f52726ef3fab4e3805150400709b61031f9015339d1b8b20acab34f3aa7f614

SHA512
2f15210e73c2f49bbd1b2ae2e6acff6b5dd886dda5f3f13bf762d471d528e80f610e8b36eb14d367cdf5bb600b4d2fc71007eb663c34faa10da2dbd62833eee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
458859817ac423a86b2f34904e662449

SHA1
e1319552b7fcc49922ca36cd2834a0e31db1d5f7

SHA256
ca636c4530641b50139c3f9559418f6fbd0453e08d1cbe85cad8151bfb432919

SHA512
e73d416edd2cbc600cd50ac8ff1b0f3c4339da17eea5d079a1ca93faca9f8c3e96f2856da56a57d50c650fb610a267767dc6774f5e46b802d4654abf4920f57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ed314d3a13c7fabce206a5b7f72a15

SHA1
e088f0b80fe3e98179a7ca99a273c452b04a6941

SHA256
6f78f23fadb3ab40d3fbb59e799a312ca0dbcff22d3c5d25e15a233e3c0bddcd

SHA512
709243bcea64a6059cb4ec74fbbec862047e3584dfa689487a19e05169e4c02bdcc0d3bf64b5ef837da2d32b963a66e52f57e49af2b8b47c802ce2fee4a4177e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c82c344bafb20ae15d767876cdf9a6f

SHA1
ccb14d0a9e0ee6055d2543ab4f35faf6d2b3f73a

SHA256
32ee8a9e47b009b5ebc8dbe0af2328984fce18c722b1d2195d8bfeb061fe1cc0

SHA512
6f92841d31c7f08f826b07d712ad1db5a9ead47c68eb7c40a1945bfcb7238a9799d749111be26faccc01bf7e22ea5f0f1fd8d56c7410503ef5bcdf05f7c4e79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b90866a83337da31b12f18971f7dccc

SHA1
1e5e0476ee4c9c7e4b4508aa6642573ce3107c6f

SHA256
c620baaea9c04a0d005921b390ea486b819c03caaad566b4edd79b52fbdaddcd

SHA512
60f9c3dbd045bffb0d5a59a9fbe248d288bfa01d2542a185714ee5a45a442a050bfe75d5cab869d6152ea9c2eff60f874686c661cac9b12d8943bfda5f55398c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA305.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA386.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit