5dd8a02a0d54e2390aa3a703e8776c94e23eba9128edac3b8a4c41a454abebab

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_tracker_local.html
Size

1KB
MD5

829e307fee543203f205da867683e4d8
SHA1

c93c4c81b6bf30ec3e4fe7c0da4a550ba29e5fd6
SHA256

61a79942092e1d3685ca18930e82cc56697e81e432a185a0298fde79fcfe396b
SHA512

61007e65a212858c355c9cff799fea23cf0032f5cefb31a3a45080463e707e34da0dc14cd51b6a099ebcec9c1b718aa2a749550864c04c2e25f3a7e02f6c6753

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC46D671-3560-11EE-BC5E-5E6847EBFE3A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008d21c16dc9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000e8da231f91de213dce0b992dc9dd044d093749df003ca370f92e8338b3bac670000000000e800000000200002000000019850c66eac32b539cb4bf61933b7ea4ffc40526ab65f9a6aaf747dac285199120000000a5299b538e502850cafbee403fcad47f96071a5dc00afd751379a6f8d4dde20b40000000a1fbabf9a015cdc3f0c21b1d738c18112c08a713143ea176f1229c2ac81163f2de06d090ce69ea5e662b97292baf1ddace717b5653548a3eed6b6af693633692	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd82794000000000200000000001066000000010000200000008c1927255da27c83c0a94c12d4379bad417c7e19cd7fb3b433ac18d3b944c67d000000000e80000000020000200000003e852d172f5e92c00fc63fefb2fcfaa703ce1de2fb45533e11a6c677f050fe5c900000007cbfcd5669802afdd84434956bf7ac29625721097fcc2ee1427972a91708114ab5df81ec522d9d9044e58130ac1f83ae10743ecfda823e4258f808215ee2a1b529913bce06c2ccc486e59f174967e4e42503f1d1f4dc9c82727e1efdd90e2364d8017f248393f1e6eb21afdd622d33fe7f530fa75d78dcc50d68c18086629eea7024f5c79863c46ad001516567b4083b4000000085835bbd0de01f02a33924783e77bd839933bd136347dee768136e570160ab0be6e410d68b49c8df020bf3538e0d725788878e31977cab0f76564920ff67ad05	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2220 iexplore.exe
2220 iexplore.exe
2148 IEXPLORE.EXE
2148 IEXPLORE.EXE
2148 IEXPLORE.EXE
2148 IEXPLORE.EXE

pid	process
2220	iexplore.exe

pid	process
2220	iexplore.exe

pid	process
2220	iexplore.exe
2220	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2220 wrote to memory of 2148	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2148	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2148	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2148	2220	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_tracker_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f045a9f8534bfcbcfd20a5e6209bf2e

SHA1
6a804bcec18bbd7aabbf378dac547628f468b243

SHA256
d10f78df473460db58c37a75bbe457bdd528b84ac63ebacb0e824ce0168b3571

SHA512
79b7d766266c0b257afa128723aba9eef12312feb6d380048c8bf44fefb9dca1cba350e2468323cdb3007c53dc40ae77729c5e9676dbb5c25ee7384594ef96ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
130c9fc9fa562a6a6d384c0834a2b050

SHA1
74d462b2c380bf4c3c4c5ba4782614c58725a04e

SHA256
423c65977d4bec1688dcf3c7efc89242f959da72c7efc3830897963e120c90e2

SHA512
ff87dbd0da76e1abf42005b0cc88eb8d22a54844f5d60e1ca8d48e7092230e6850e39e032f1e21afaefd83b4156bf65ad41b7fcaafabd6e356310fab1d4f9b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4e2874455976a4383cdddbb66aab74

SHA1
291f72793f145310769eec1a279ba1f4266ff455

SHA256
ed01c2a4c1333f8ab8a211e7b39981e06437c4544037b523717cb4c1e782dd4e

SHA512
73d5055c6522f347d3dacd28498177cb2cd0008a3f45a6ce6ca3140d5481fd8841a26b8bc145adfe67f6b644fe3b60c24b80b02e6c1cf0731f587a7757bbc264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
782e500d5b2b8835746d6ab2173101a7

SHA1
2f71c6ac0b783724ab75dfe21af9c1cca17e755a

SHA256
37741122b2faf3b45640b79d3ba8dccb23dc170751a5fa7356e32e058a1b6319

SHA512
b0211730e234da157d4327fd89bf6dee406dc21f0166172e50f4a79f06c630ba9ab938c1906afb7248847a7b829a00cb0cb9352437841cce8355768b5b50cf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
839cc94c6fb48fca3be6b126d9c97c91

SHA1
ebd3cb6fc5279f96777c67ab62b67c544d6a57c1

SHA256
a6310a0cc2720ddc53d2dce3367ed5991607972c48b40a95338a4859d2ca23d6

SHA512
1dc4ea4d0e03aee1428a0f50246568a71f309d79d17b5133c03a12312e0368ad93961f1d157fa34194e9301ead29b216e77e57f7c2f9f540987a7a97b9178c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ccd2adefa3067166d4009f75554a7c

SHA1
78762682ed0671d5548d3871e7768e58e75c9973

SHA256
4e40f07d9b59c740b16dd8ef1fcb6754bbc26632d33da014b98ebfa192a89377

SHA512
a2c7abcdc7e52a48f0cf40fd5751ec2f58aec6819a7943cd939312195182cc27f0947764177a330c88eb6da8c22883b5171e753eefea968b87d3416722a6bcbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dea30c1efb645c89211339545c70b6c

SHA1
c85ac4b72cc7d3cfb283d74c334fd7ae3fe3364c

SHA256
385b5f2068d55d5ca658ea255a968b574bd9bc35e81c7b29fcc2543c0b4ce939

SHA512
aaaf0067cd5ec9a9cd320ae75a582ac38c4a2f5dfe759853b6cdb690ffb624922de79c193251d78b43ff3ada64fbd1bd925609057370178949b9ba271ed9dad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d6ea2ca17c6e23fdcdea836d36a8f6

SHA1
094b787eb9913dc68922918470f98a25cbbae651

SHA256
18c111b31b6cd3d71c20f321d6bc872de19752c31f018680d4f4cbc8ae036b9c

SHA512
3b8d6503d16cffa1d159dcee6ffc0086241255a83d8bc5a051a6388787495f335c1578575079ff1db40794a40f7786087e180be8b6e8e0c46d148a6dca5ea32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c31bd66232353a053fb47414318bf2e

SHA1
8ebab2eda470bfae57af7a06140ae188ca7883f7

SHA256
4a3f13e7e99a546830a4d59845ad75e361a4b147611b863b06320c6dd4e7997e

SHA512
adebf74d9323ab7b9598e6ba9c2f142bb8489da2939ddd7f7a1e6d98787e974a229ac4b454e62bc52a7268a705922a22f67517a23d4098b1d800a49d0bac4f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67c9aedea59c702eeccf56e975eea0d1

SHA1
5d208c62092b793abcebe002fc7b21d6797961c0

SHA256
f495ca9ef522aca7154b65166ed3aa42ebf59791537d7532ca6c4490184c5ecd

SHA512
7765d32dbec76f4c90d4034fb2dd238a0e2e689b7eed5c5237722066935cdfcfda1fcb4c3599ab4411a7c349781bdfe02c17a010f2b848646256c5ed3316dfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA44.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA86.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit